Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Ory Polis, formerly known as BoxyHQ Jackson, bridges or proxies a SAML login flow to OAuth 2.0 or OpenID Connect. Versions prior to 26.2.0 contain a DOM-based Cross-Site Scripting (XSS) vulnerability in Ory Polis's login functionality. The application improperly trusts a URL parameter (`callbackUrl`), which is passed to `router.push`. An attacker can craft a malicious link that, when opened by an authenticated user (or an unauthenticated user that later logs in), performs a client-side redirect and executes arbitrary JavaScript in the context of their browser. This could lead to credential theft, internal network pivoting, and unauthorized actions performed on behalf of the victim. Version 26.2.0 contains a patch for the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
[CVE-2026-33506: HIGH] Security alert: Ory Polis versions <26.2.0 have a DOM-based XSS vulnerability in login flow. Always update to the latest version to stay protected.#cve,CVE-2026-33506,#cybersecurity https://cvefind.com/CVE-2026-33506
Post summary
The alert announces a DOM‑based XSS flaw in Ory Polis versions below 26.2.0 and recommends updating to the latest version to mitigate the risk.
CVE-2026-33506 Ory Polis, formerly known as BoxyHQ Jackson, bridges or proxies a SAML login flow to OAuth 2.0 or OpenID Connect. Versions prior to 26.2.0 contain a DOM-based Cross-S… https://www.cve.org/CVERecord?id=CVE-2026-33506
Post summary
The statement announces a DOM‑based Cross‑Site Scripting vulnerability in Ory Polis (formerly BoxyHQ Jackson) affecting versions prior to 26.2.0, but provides no exploit, mitigation, or evidence of active attacks.
🟠 CVE-2026-33506 - High Ory Polis, formerly known as BoxyHQ Jackson, bridges or proxies a SAML login flow to OAuth 2.0 or OpenID Connect. Versions prior to 26.2.0 contain a DOM-based Cross-Site Scripting (XSS) vulne... https://www.thehackerwire.com/vulnerability/CVE-2026-33506/ https://t.co/arkCMhxJF1
Post summary
A new high‑severity DOM‑based XSS vulnerability (CVE‑2026‑33506) affecting Ory Polis versions prior to 26.2.0 was disclosed, but no PoC, exploit, patch, or activity details were included.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | ory | polis | - | - | - |