Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack. When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this vulnerability therefore executes with full access to the host application's cookies, DOM, and same-origin APIs — an attacker can reach all resources of the host application, not just Unblu's. This expanded blast radius is the reason on-premises deployments using this configuration are rated CRITICAL.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
🐛 VULNERABILITIES CVE Notify: 🚨 [CVE-2026-8152](https://docs.unblu.com/latest/security-bulletins/#UBL-2026-001) Unblu Spark conta... https://docs.unblu.com/latest/security-bulletins/#UBL-2026-001 #ZeroDay #PatchManagement #Vulnerability
Post summary
The tweet announces CVE‑2026‑8152 and directs readers to a security bulletin, indicating a disclosure of a newly identified vulnerability.
🚨Critical - Unblu Spark Open Redirect to DOM-Based XSS (CVE-2026-8152) Unblu Spark contains an open redirect that can be escalated to DOM-based XSS. When deployed with com.unblu.identifier.siteEmbeddedSetup=true, Spark runs in the same origin as the host application, so injected JavaScript executes with full access to the host app's cookies, DOM, and same-origin APIs. An attacker can therefore reach all resources of the host application, not just Unblu's - session theft and actions as the victim. Because Unblu Spark is widely used by banks and insurers, that blast radius is significant. Delivery requires the victim to follow a crafted link. CVSS 9.3. 👉Upgrade Unblu Spark to 8.36.1-hotfix.0 or 8.37.0.
Post summary
CVE-2026-8152 is a critical open‑redirect leading to DOM‑based XSS in Unblu Spark, affecting bank and insurance web apps; vendors have issued hotfixes to mitigate the CVSS 9.3 vulnerability.