CVE-2026-33506 - Vulnerability Analysis

Overview

Ory Polis < 26.2.0 contains a stored XSS caused by improper trust of the 'callbackUrl' parameter in login functionality, letting attackers execute arbitrary JavaScript in victim's browser, exploit requires victim to open crafted link and be authenticated or log in afterwards.

Severity & Score

Impact

Attackers can execute arbitrary JavaScript in victim's browser, leading to credential theft and unauthorized actions.

Mitigation

Update to version 26.2.0 or later.

References

• https://github.com/ory/polis/security/advisories/GHSA-3wjr-6gw8-9j22
• https://github.com/ory/polis/releases/tag/v26.2.0

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 26, 2026

🟠 CVE-2026-33506 - High (8.8) Ory Polis, formerly known as BoxyHQ Jackson, bridges or proxies a SAML login flow to OAuth 2.0 or OpenID Connect. Versions prior to 26.2.0 contain a DOM-based Cross-Site Scripting (XSS) vulnerability in Ory Polis's login functionality. The applica... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33506/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner