CVE-2026-33506

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33506", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-20T16:59:08.888Z", "datePublished": "2026-03-26T18:48:15.516Z", "dateUpdated": "2026-03-26T19:52:10.429Z"}, "containers": {"cna": {"title": "DOM-Based XSS in Ory Polis Login Page", "problemTypes": [{"descriptions": [{"cweId": "CWE-87", "lang": "en", "description": "CWE-87: Improper Neutralization of Alternate XSS Syntax", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-601", "lang": "en", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/ory/polis/security/advisories/GHSA-3wjr-6gw8-9j22", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ory/polis/security/advisories/GHSA-3wjr-6gw8-9j22"}, {"name": "https://github.com/ory/polis/releases/tag/v26.2.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/ory/polis/releases/tag/v26.2.0"}], "affected": [{"vendor": "ory", "product": "polis", "versions": [{"version": "< 26.2.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-26T18:48:15.516Z"}, "descriptions": [{"lang": "en", "value": "Ory Polis, formerly known as BoxyHQ Jackson, bridges or proxies a SAML login flow to OAuth 2.0 or OpenID Connect. Versions prior to 26.2.0 contain a DOM-based Cross-Site Scripting (XSS) vulnerability in Ory Polis's login functionality. The application improperly trusts a URL parameter (`callbackUrl`), which is passed to `router.push`. An attacker can craft a malicious link that, when opened by an authenticated user (or an unauthenticated user that later logs in), performs a client-side redirect and executes arbitrary JavaScript in the context of their browser. This could lead to credential theft, internal network pivoting, and unauthorized actions performed on behalf of the victim. Version 26.2.0 contains a patch for the issue."}], "source": {"advisory": "GHSA-3wjr-6gw8-9j22", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33506", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-26T19:47:49.460726Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T19:52:10.429Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33506", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-26T19:47:49.460726Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T19:50:30.733Z"}}], "cna": {"title": "DOM-Based XSS in Ory Polis Login Page", "source": {"advisory": "GHSA-3wjr-6gw8-9j22", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "ory", "product": "polis", "versions": [{"status": "affected", "version": "< 26.2.0"}]}], "references": [{"url": "https://github.com/ory/polis/security/advisories/GHSA-3wjr-6gw8-9j22", "name": "https://github.com/ory/polis/security/advisories/GHSA-3wjr-6gw8-9j22", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/ory/polis/releases/tag/v26.2.0", "name": "https://github.com/ory/polis/releases/tag/v26.2.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Ory Polis, formerly known as BoxyHQ Jackson, bridges or proxies a SAML login flow to OAuth 2.0 or OpenID Connect. Versions prior to 26.2.0 contain a DOM-based Cross-Site Scripting (XSS) vulnerability in Ory Polis's login functionality. The application improperly trusts a URL parameter (`callbackUrl`), which is passed to `router.push`. An attacker can craft a malicious link that, when opened by an authenticated user (or an unauthenticated user that later logs in), performs a client-side redirect and executes arbitrary JavaScript in the context of their browser. This could lead to credential theft, internal network pivoting, and unauthorized actions performed on behalf of the victim. Version 26.2.0 contains a patch for the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-87", "description": "CWE-87: Improper Neutralization of Alternate XSS Syntax"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-601", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-26T18:48:15.516Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33506", "state": "PUBLISHED", "dateUpdated": "2026-03-26T19:52:10.429Z", "dateReserved": "2026-03-20T16:59:08.888Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-26T18:48:15.516Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "polis", "vendor": "ory", "versions": [{"status": "affected", "version": "< 26.2.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ory:polis:*:*:*:*:*:*:*:*", "matchCriteriaId": "35374CF5-7055-4168-AE87-931558915B5C", "versionEndExcluding": "26.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Ory Polis, formerly known as BoxyHQ Jackson, bridges or proxies a SAML login flow to OAuth 2.0 or OpenID Connect. Versions prior to 26.2.0 contain a DOM-based Cross-Site Scripting (XSS) vulnerability in Ory Polis's login functionality. The application improperly trusts a URL parameter (`callbackUrl`), which is passed to `router.push`. An attacker can craft a malicious link that, when opened by an authenticated user (or an unauthenticated user that later logs in), performs a client-side redirect and executes arbitrary JavaScript in the context of their browser. This could lead to credential theft, internal network pivoting, and unauthorized actions performed on behalf of the victim. Version 26.2.0 contains a patch for the issue."}, {"lang": "es", "value": "Ory Polis, anteriormente conocido como BoxyHQ Jackson, act\u00faa como puente o proxy para un flujo de inicio de sesi\u00f3n SAML a OAuth 2.0 o OpenID Connect. Las versiones anteriores a la 26.2.0 contienen una vulnerabilidad de cross-site scripting (XSS) basada en DOM en la funcionalidad de inicio de sesi\u00f3n de Ory Polis. La aplicaci\u00f3n conf\u00eda indebidamente en un par\u00e1metro de URL ('callbackUrl'), el cual se pasa a `router.push`. Un atacante puede crear un enlace malicioso que, al ser abierto por un usuario autenticado (o un usuario no autenticado que luego inicia sesi\u00f3n), realiza una redirecci\u00f3n del lado del cliente y ejecuta JavaScript arbitrario en el contexto de su navegador. Esto podr\u00eda conducir a robo de credenciales, pivoteo de red interno y acciones no autorizadas realizadas en nombre de la v\u00edctima. La versi\u00f3n 26.2.0 contiene un parche para el problema."}], "id": "CVE-2026-33506", "lastModified": "2026-06-17T10:37:37.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.3, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33506", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-26T19:47:49.460726Z", "version": "2.0.3"}}]}, "published": "2026-03-26T19:17:05.680", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/ory/polis/releases/tag/v26.2.0"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/ory/polis/security/advisories/GHSA-3wjr-6gw8-9j22"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-87"}, {"lang": "en", "value": "CWE-601"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,26.2.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "polis", "source": "cna", "vendor": "ory"}, "product": "polis", "vendor": "ory"}], "analysis": {"en": {"generated_at": "2026-03-26T20:52:42.006220+00:00", "value": {"mitigation_remediation": ["Upgrade Ory Polis to version 26.2.0 or later", "Verify that callbackUrl values are properly validated or sanitized before being used in router.push"], "summary": {"action": "Patch", "impact": "Client\u2011side code execution via XSS"}, "threat_synthesis": {"affected_systems": "All releases of the Ory Polis identity\u2011and\u2011access\u2011management service before version 26.2.0 are affected. The vulnerability exists in the login component where the callbackUrl parameter is processed. Systems running 26.2.0 or later contain the patch that validates or sanitises the callbackUrl value.", "description_and_impact": "An attacker can craft a malicious link that sets the callbackUrl query parameter to an arbitrary value. Ory Polis blindly trusts this value and passes it to the client\u2011side router, which results in a redirect and execution of any JavaScript contained in the URL. This DOM\u2011based Cross\u2011Site Scripting exploits improper handling of parameters (CWE\u201187) and an open redirect flaw (CWE\u2011601). When this code runs in the victim\u2019s browser it can steal credentials, pivot within the internal network, or perform unauthorized actions on behalf of the user.", "risk_and_exploitability": "The flaw carries a high CVSS base score of 8.8, indicating a serious client\u2011side risk. Because the exploit occurs only in the user\u2019s browser and requires the user to click a malicious link, no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, credential theft and lateral movement make it a significant concern. The likely attack vector is a phishing or social\u2011engineering campaign that delivers a crafted URL to an authenticated or soon\u2011to\u2011be authenticated user."}}}}, "created": "2026-03-27T08:33:22.035023+00:00", "updated": "2026-03-27T09:25:43.600242+00:00", "vendors": ["ory", "ory$PRODUCT$polis"]}