External risk intelligence

Unblu Spark Open Redirect to DOM XSS in Embedded Deployments

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-8152

Unblu Spark is designed as a customer engagement and chat solution typically integrated directly into public-facing websites. Because it is intended to interact with end users on live web platforms, the surface is commonly deployed in internet-facing web applications.

Cross-site Scripting

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability in Unblu Spark could allow an attacker to execute malicious code within your host application, potentially accessing sensitive data and resources. The risk is particularly high for on-premises deployments that use specific configurations.

Redirects can lead to dangerous code execution.
High risk in on-premises, integrated deployments.
Confirm if your integrated web applications are affected.

Attack Path

How an attacker could exploit the issue

An attacker can exploit an open redirect vulnerability in Unblu Spark to achieve DOM-based cross-site scripting (XSS). This occurs when the product is configured to run within the same security domain as a host application. By manipulating the redirect, an attacker can inject malicious JavaScript that executes with the same privileges as the host application, allowing them to access sensitive data and functionality.

Entry condition: Unblu Spark deployed with a specific configuration.
Trigger point: Manipulated redirect to trigger JavaScript injection.
Resulting risk: Full access to host application's data.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to execute malicious JavaScript within the context of your host application when Unblu Spark is configured with specific settings. This could lead to unauthorized access to your application's sensitive data and functionality.

Host application data and cookies at risk.
Redirect to a malicious site.
Compromise of host application resources.

Operational Fix

Recommended remediation, mitigation, and detection steps

For on-premises deployments of Unblu Spark with the `com.unblu.identifier.siteEmbeddedSetup=true` configuration, the critical nature of this vulnerability necessitates immediate action from teams responsible for the host application. The first practical move is to identify all instances of Unblu Spark in this configuration, confirm their reachability and business criticality, and then engage the accountable application or platform owner to plan a risk-based remediation strategy.

Host application owners and platform teams.
Verify Unblu Spark deployment configuration and reachability.
Plan remediation based on identified risk and business impact.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Unblu Spark?

Unblu Spark is a specialized customer engagement and live chat software component. Organizations integrate it into their websites to enable real-time communication between their staff and site visitors. Because it functions as an embedded feature, it is designed to operate directly within the web pages of a host application.

What is the vulnerability in CVE-2026-8152?

This vulnerability involves an open redirect flaw that escalates into DOM-based Cross-Site Scripting (XSS). An open redirect allows an attacker to manipulate links to send users to unintended destinations. When chained with DOM-based XSS, the attacker can force the victim's browser to execute malicious JavaScript, potentially compromising the data handled by the web page.

How can an attacker trigger this issue?

An attacker triggers this by providing a crafted URL that exploits the redirect flaw, leading to script execution. This specific risk requires the software to be deployed with the setting 'com.unblu.identifier.siteEmbeddedSetup=true'. If this configuration is disabled, the software does not share the same origin as the host application, which significantly limits the attacker's ability to access the host's cookies and sensitive data.

Is my site at risk according to Halo Surface Signal?

Yes, if you use Unblu Spark in an internet-facing capacity. Halo Surface Signal identifies this software as typically being integrated into public-facing websites to interact with users. Because these deployments are exposed to the internet, they are naturally reachable by attackers attempting to manipulate site features like redirects.

Do I need to check my configuration for CVE-2026-8152?

Yes, if you manage on-premises deployments. You should first verify if your instances have the embedded configuration enabled. Once you identify which applications are running in this mode, coordinate with the platform owners to assess the risk and determine the appropriate remediation steps to protect your host application's data and resources.

References

docs.unblu.com/latest/security-bulletins/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.