XSS in Ory Polis
CVE-2026-33506
Ory Polis, formerly known as BoxyHQ Jackson, bridges or proxies a SAML login flow to OAuth 2.0 or OpenID Connect. Versions prior to 26.2.0 contain a DOM-based Cross-Site Scripting (XSS) vulnerability in Ory Polis's login functionality. The application improperly trusts a URL parameter (`callbackUrl`), which is passed to `router.push`. An attacker can craft a malicious link that, when opened by an authenticated user (or an unauthenticated user that later logs in), performs a client-side redirect and executes arbitrary JavaScript in the context of their browser. This could lead to credential theft, internal network pivoting, and unauthorized actions performed on behalf of the victim. Version 26.2.0 contains a patch for the issue.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L.
EPSS exploit prediction
EPSS: 0.004 (33.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 33rd percentile — 33.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.004 · change: -0.000
Affected products
- Ory Polis — versions < 26.2.0
Weakness classification (CWE)
References
- github.com/ory/polis/security/advisories/GHSA-3wjr-6gw8-9j22 (Exploit, Mitigation, Vendor Advisory)
- github.com/ory/polis/releases/tag/v26.2.0 (Product, Release Notes)
Frequently asked questions
- What is CVE-2026-33506?
- CVE-2026-33506 is a high-severity vulnerability in Ory Polis, classified under Improper Neutralization of Alternate XSS Syntax. CVSS score: 8.8/10. Published 2026-03-26.
- How severe is CVE-2026-33506?
- High severity. CVSS v3 base score is 8.8 out of 10.