CVE-2026-33506 Details
Description
Ory Polis, formerly known as BoxyHQ Jackson, bridges or proxies a SAML login flow to OAuth 2.0 or OpenID Connect. Versions prior to 26.2.0 contain a DOM-based Cross-Site Scripting (XSS) vulnerability in Ory Polis's login functionality. The application improperly trusts a URL parameter (`callbackUrl`), which is passed to `router.push`. An attacker can craft a malicious link that, when opened by an authenticated user (or an unauthenticated user that later logs in), performs a client-side redirect and executes arbitrary JavaScript in the context of their browser. This could lead to credential theft, internal network pivoting, and unauthorized actions performed on behalf of the victim. Version 26.2.0 contains a patch for the issue.
A DOM-based Cross-Site Scripting (XSS) vulnerability has been identified in Ory Polis, specifically in versions prior to 26.2.0. The issue arises in the login functionality, where the application improperly trusts a URL parameter, 'callbackUrl', which is passed to 'router.push' without adequate validation. This flaw allows an attacker to craft a malicious link that, when clicked by an authenticated user or an unauthenticated user who subsequently logs in, executes arbitrary JavaScript in the context of the user's browser. Such exploitation could lead to credential theft, unauthorized actions on behalf of the user, and internal network pivoting if the user has access to internal systems.
Users can update to Ory Polis version 26.2.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ory/polis/releases/tag/v26.2.0 | [email protected] | ProductRelease Notes |
| https://github.com/ory/polis/security/advisories/GHSA-3wjr-6gw8-9j22 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
| CWE-87 | Improper Neutralization of Alternate XSS Syntax | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ory polis | < 26.2.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 17, 2026 | Initial Analysis | [email protected] |
| Mar 26, 2026 | New CVE Received | [email protected] |