CVE-2026-8152 describes an open redirect vulnerability in Unblu Spark that can be escalated to a DOM-based XSS attack. When Unblu Spark is deployed with the setting com.unblu.identifier.siteEmbeddedSetup=true, it shares the same origin as the host application. This allows any malicious JavaScript injected via the open redirect to execute with full privileges over the host application's resources, including cookies and DOM access. The vulnerability is rated critical with a CVSS 4.0 score of 9.3. No patch or remediation level has been published, and the vulnerability is not related to a cloud service. The expanded blast radius in on-premises deployments using this configuration is the primary reason for the critical severity.

Successful exploitation allows an attacker to perform DOM-based cross-site scripting within the context of the host application, gaining access to sensitive resources such as cookies, DOM elements, and same-origin APIs. This can lead to full compromise of the host application's session and data. The vulnerability is critical due to the high privileges granted by the same-origin context and the ease of exploitation via open redirect.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider disabling or avoiding the use of the com.unblu.identifier.siteEmbeddedSetup=true configuration to reduce exposure. Monitor vendor communications for updates on patches or official mitigations.