CVE-2026-8152: critical vulnerability in Unblu Spark
Unblu Spark Open Redirect leading to DOM-Based XSS
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.3epss 0.4%
Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack.
When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this vulnerability therefore executes with full access to the host application's cookies, DOM, and same-origin APIs — an attacker can reach all resources of the host application, not just Unblu's. This expanded blast radius is the reason on-premises deployments using this configuration are rated CRITICAL.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Affected products
Unblu inc. · Unblu SparkRelated CVEs — Unblu Spark
In the same product, most dangerous first.
CVE-2026-14933HIGHUnblu Spark Cross-Site Scripting in Embedded Co-BrowsingEPSS 0.6%CVE-2026-9589CRITICALUnblu Spark Authorization Bypass in Configuration Cascade OperationsEPSS 0.4%CVE-2025-3519HIGHReplace uploaded files knowing the file upload IDEPSS 0.3%CVE-2025-3518MEDIUMFile upload functionality possible even when disabledEPSS 0.2%