Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-8152 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack. When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this vulnerability therefore executes with full access to the host application's cookies, DOM, and same-origin APIs — an attacker can reach all resources of the host application, not just Unblu's. This expanded blast radius is the reason on-premises deployments using this configuration are rated CRITICAL.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:6.1 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://docs.unblu.com/latest/security-bulletins/#UBL-2026-001	[email protected]	AdvisoryBundleRemedyVendor

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-601	URL Redirection to Untrusted Site ('Open Redirect')	[email protected]
CWE-79	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	[email protected]

Affected Products

Product	Versions
Unblu Spark	<= 8.36.1 (semver)
CPE No CPEs found in CPE dictionary for this product. Remediation Upgrade: 8.36.1-hotfix.0moderate efforthttps://docs.unblu.com/latest/release-notes/#unblu-8-36-1-hotfix-0-release-notes Workaround: (~7.56, ~8.19)moderate effort Set the configuration property `com.unblu.contentsecuritypolicy.mode` to `on`. This will enable the built-in Content Security Policy (CSP) that blocks the execution of injected JavaScript. This workaround is only effective on Unblu Spark 7.56.2 and later in the 7.x series, and 8.19.1 and later in the 8.x series, where Unblu removed `unsafe-inline` from the script source policy. Mitigation:moderate effort Configure a Web Application Firewall (WAF) rule to block requests whose `redirectOnFailure` parameter contains a malicious payload, particularly values that include a `javascript:` scheme or obfuscated variants of it.

Product

Versions

Unblu Spark

<= 8.36.1 (semver)

CPE

No CPEs found in CPE dictionary for this product.

Remediation

Upgrade: 8.36.1-hotfix.0moderate efforthttps://docs.unblu.com/latest/release-notes/#unblu-8-36-1-hotfix-0-release-notes
Workaround: (~7.56, ~8.19)moderate effort
Set the configuration property `com.unblu.contentsecuritypolicy.mode` to `on`. This will enable the built-in Content Security Policy (CSP) that blocks the execution of injected JavaScript. This workaround is only effective on Unblu Spark 7.56.2 and later in the 7.x series, and 8.19.1 and later in the 8.x series, where Unblu removed `unsafe-inline` from the script source policy.
Mitigation:moderate effort
Configure a Web Application Firewall (WAF) rule to block requests whose `redirectOnFailure` parameter contains a malicious payload, particularly values that include a `javascript:` scheme or obfuscated variants of it.

Change History

2 change records found show changes

Date	Action	Recorded By
Jul 22, 2026	CVE Modified	CISA-ADP
Jul 22, 2026	New CVE Received	[email protected]