XSS in Unblu Inc. Spark
CVE-2026-8152
Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack. When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the…
Vulnerability class: XSS (Cross-Site Scripting)
Affected products
- Unblu Inc. Spark — versions 0, 8.36.1-hotfix.0, 8.37.0
Weakness classification (CWE)
References
- vulnerability@ncsc.ch (vendor-advisory)