Unblu Spark EUVD-2026-47656

Unblu Spark contains a critical DOM-based cross-site scripting vulnerability reachable via open-redirect that enables unauthenticated attackers to steal user session credentials and compromise host applications when Spark shares the host's origin. Organizations using embedded Spark deployments with siteEmbeddedSetup=true face immediate risk of data breach and loss of control over host application sessions.

Within 24 hours, inventory all Unblu Spark deployments and prioritize those with siteEmbeddedSetup=true enabled; restrict non-essential user access to shared Spark links and alert your security team to watch for suspicious redirection attempts. Within 7 days, implement Web Application Firewall rules to block open-redirect parameter patterns targeting Spark; coordinate with Unblu Support for patch delivery timelines and interim fixes; review host application access logs for signs of session hijacking or unauthorized activity. Within 30 days, evaluate whether siteEmbeddedSetup=true can be disabled for non-critical workflows; develop and test a patch deployment plan; conduct a full review of host application session logs for evidence of credential compromise.

Implement strict input validation and encoding on all URL redirect parameters in Spark configuration; deploy WAF rules to block common open-redirect attack patterns; disable siteEmbeddedSetup=true wherever operationally feasible; mark all host application session cookies as HttpOnly and Secure; monitor host application session activity logs for anomalous credential usage and concurrent sessions; implement Content Security Policy (CSP) headers on the host application to restrict JavaScript execution scope; consider network-level IP restrictions on Spark endpoints to limit exposure surface.