Open redirect and DOM-based XSS in Unblu Spark (CVE-2026-8152)

Unblu Spark contains an open redirect vulnerability via the redirectOnFailure parameter that can be escalated to DOM-based cross-site scripting (XSS). When deployed with com.unblu.identifier.siteEmbeddedSetup=true, the application runs in the same origin as the host application, allowing injected JavaScript to access all host application cookies, DOM, and same-origin APIs. This expanded blast radius results in a CRITICAL severity rating for on-premises deployments using this configuration. Affected versions: - 8.36.1 We recommend updating to: 8.36.1-hotfix.0. CVSS 9.3 · our assessment: act_now Reference: https://docs.unblu.com/latest/security-bulletins/#UBL-2026-001 Details: https://vuln.today/cve/CVE-2026-8152