Which versions of Open Redirect are affected by EUVD-2026-47656?

Unblu Spark contains a critical DOM-based cross-site scripting vulnerability reachable via open-redirect that enables unauthenticated attackers to steal user session credentials and compromise host…

How to fix or mitigate EUVD-2026-47656?

Within 24 hours, inventory all Unblu Spark deployments and prioritize those with siteEmbeddedSetup=true enabled; restrict non-essential user access to shared Spark links and alert your security team to watch for suspicious redirection attempts. Within 7 days, implement Web Application Firewall rules to block open-redirect parameter patterns targeting Spark; coordinate with Unblu Support for patch delivery timelines and interim fixes; review host application access logs for signs of session hijacking or unauthorized activity. Within 30 days, evaluate whether siteEmbeddedSetup=true can be disabled for non-critical workflows; develop and test a patch deployment plan; conduct a full review of host application session logs for evidence of credential compromise.

Open Redirect EUVD-2026-47656

Q: What is the CVSS score of EUVD-2026-47656?

EUVD-2026-47656 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-8152 CRITICAL

URL Redirection to Untrusted Site (Open Redirect) (CWE-601)

2026-07-22 NCSC.ch

GHSA-6f3h-gqrm-69gc

XSS Open Redirect Unblu Spark

9.3

CVSS 4.0 · Vendor: NCSC.ch

Severity by source

Vendor (NCSC.ch) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (NCSC.ch) · only source for this CVE.

CVSS VectorVendor: NCSC.ch

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 13:20 vuln.today

CVE Published

Jul 22, 2026 - 12:21 cve.org

CRITICAL 9.3

DescriptionCVE.org

Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack.

When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this vulnerability therefore executes with full access to the host application's cookies, DOM, and same-origin APIs - an attacker can reach all resources of the host application, not just Unblu's. This expanded blast radius is the reason on-premises deployments using this configuration are rated CRITICAL.

AnalysisAI

DOM-based cross-site scripting in Unblu Spark, reachable via an open-redirect flaw (CWE-601), lets remote attackers execute arbitrary JavaScript in a victim's browser after luring them to a crafted link. When Spark runs with com.unblu.identifier.siteEmbeddedSetup=true it shares the host application's origin, so injected script inherits full access to the host app's cookies, DOM, and same-origin APIs, expanding the blast radius well beyond Unblu itself and driving the CRITICAL 9.3 (CVSS 4.0) rating for on-prem embedded deployments. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.