CVE-2026-33506 is a DOM-based Cross-Site Scripting vulnerability in Ory Polis, a software component that proxies SAML login flows to OAuth 2.0 or OpenID Connect. The vulnerability stems from the application's unsafe handling of the 'callbackUrl' URL parameter, which is directly passed to the client-side router.push function without proper sanitization or validation. This improper neutralization of alternate XSS syntax (CWE-87) allows an attacker to craft a malicious URL that, when visited by an authenticated user or a user who subsequently logs in, triggers execution of arbitrary JavaScript in the victim's browser context. This can lead to theft of authentication credentials, session hijacking, and unauthorized actions performed on behalf of the victim. Additionally, attackers may leverage this access to pivot into internal networks. The vulnerability affects all versions of Ory Polis prior to 26.2.0, which includes the formerly named BoxyHQ Jackson product. The patch in version 26.2.0 corrects the handling of the callbackUrl parameter to prevent injection of malicious scripts. The vulnerability has a CVSS v3.1 base score of 8.8, indicating a high severity with network attack vector, low attack complexity, no privileges required, but requiring user interaction. Although no exploits have been reported in the wild, the vulnerability's nature and impact make it a critical risk for organizations relying on Ory Polis for identity federation and authentication bridging.

The impact of CVE-2026-33506 is significant for organizations using Ory Polis in their authentication infrastructure. Successful exploitation can lead to client-side script execution in the context of the victim's browser, enabling attackers to steal sensitive credentials such as session tokens or cookies. This can result in unauthorized access to protected resources and user accounts. Furthermore, attackers may perform actions on behalf of the victim, potentially escalating privileges or manipulating application workflows. The ability to pivot into internal networks increases the risk of lateral movement and further compromise within an organization's environment. The vulnerability affects the confidentiality, integrity, and availability of systems relying on Ory Polis for authentication. Given the network attack vector and no requirement for privileges, the threat can be exploited remotely by enticing users to click malicious links, increasing the attack surface. Organizations with high-value targets or sensitive data are at elevated risk, especially if they have not applied the patch in version 26.2.0.

To mitigate CVE-2026-33506, organizations should immediately upgrade Ory Polis to version 26.2.0 or later, where the vulnerability is patched. Until the upgrade is applied, implement strict input validation and sanitization on the 'callbackUrl' parameter to prevent injection of malicious scripts. Employ Content Security Policy (CSP) headers to restrict the execution of unauthorized scripts in browsers. Monitor web traffic and logs for suspicious URL parameters or unusual redirect patterns that could indicate exploitation attempts. Educate users about the risks of clicking untrusted links, especially those related to authentication flows. Additionally, consider implementing multi-factor authentication (MFA) to reduce the impact of credential theft. Conduct regular security assessments and penetration testing focused on authentication components to detect similar vulnerabilities. Finally, maintain an incident response plan to quickly address any exploitation attempts.