CVE-2026-8152 in Spark
Summary
by MITRE • 07/22/2026
Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack.
When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this vulnerability therefore executes with full access to the host application's cookies, DOM, and same-origin APIs — an attacker can reach all resources of the host application, not just Unblu's. This expanded blast radius is the reason on-premises deployments using this configuration are rated CRITICAL.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/22/2026
The vulnerability in question represents a critical security flaw within Unblu Spark that combines open redirect and DOM-based cross-site scripting capabilities to create an elevated attack surface. This issue manifests when the application is configured with com.unblu.identifier.siteEmbeddedSetup=true, which places Unblu Spark in the same origin as the host application, fundamentally altering the security boundaries between systems.
The technical flaw exploits an open redirect mechanism that allows attackers to manipulate URL parameters to redirect users to malicious domains while maintaining the appearance of legitimate navigation. When this vulnerability is combined with DOM-based XSS conditions, it creates a powerful attack vector where JavaScript code injected through the redirect can execute within the host application's security context. This configuration essentially removes the security isolation that typically protects Unblu Spark from direct access to the host application's resources, enabling attackers to leverage the same-origin policy to their advantage.
The operational impact of this vulnerability is severe and far-reaching, particularly for on-premises deployments that utilize the embedded setup configuration. Attackers can exploit this flaw to execute arbitrary JavaScript code with full privileges within the host application environment, gaining access to sensitive cookies, DOM elements, and same-origin APIs that are normally protected. This expanded blast radius means that an attacker who successfully exploits this vulnerability can access all resources of the host application rather than being limited to Unblu's own functionality, potentially compromising entire enterprise applications and their underlying data.
The security implications extend beyond simple data theft, as this vulnerability allows for complete session hijacking, privilege escalation, and potential lateral movement within networked environments. The embedded nature of the setup means that attackers can leverage legitimate application trust relationships to bypass traditional security controls. This vulnerability aligns with CWE-601 open redirect weaknesses and ATT&CK technique T1534 for exploitation of web application vulnerabilities, representing a sophisticated attack pattern that combines multiple exploit vectors.
Organizations should implement immediate mitigations including disabling the embedded setup configuration when not required, implementing strict input validation and sanitization for all URL parameters, and deploying Content Security Policy (CSP) headers to prevent unauthorized script execution. Regular security assessments should verify that the com.unblu.identifier.siteEmbeddedSetup parameter is properly configured according to organizational security requirements, with additional monitoring for suspicious redirect patterns in application logs. The vulnerability demonstrates the critical importance of proper configuration management in enterprise applications and highlights how seemingly minor configuration options can create significant security risks when combined with other attack vectors.