PT-2026-28487 · Ory+1 · Ory Polis+1

Published 2026-03-26 · Updated 2026-03-26 · CVE-2026-33506

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Ory Polis versions prior to 26.2.0

Description Ory Polis, previously known as BoxyHQ Jackson, functions as a bridge or proxy for a SAML login flow to OAuth 2.0 or OpenID Connect. Versions prior to 26.2.0 are susceptible to a DOM-based Cross-Site Scripting (XSS) issue within the login functionality. The application inappropriately trusts a URL parameter, callbackUrl, which is then passed to the router.push function. An attacker can create a malicious link that, when opened by an authenticated user (or an unauthenticated user who subsequently logs in), can trigger a client-side redirection and execute arbitrary JavaScript code within the user's browser. This could potentially lead to credential theft and unauthorized actions performed on behalf of the victim.

Recommendations Versions prior to 26.2.0 should be updated to version 26.2.0 or later.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

CWE-87

Related Identifiers

CVE-2026-33506

GHSA-3WJR-6GW8-9J22

Affected Products

Boxyhq Jackson

Ory Polis

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33506.json · Exploit
• https://github.com/ory/polis/security/advisories/GHSA-3wjr-6gw8-9j22 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33506 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33506 · Vendor Advisory
• https://github.com/ory/polis/releases/tag/v26.2.0 · Note
• https://twitter.com/CveFindCom/status/2037254052367507655 · Twitter Post
• https://twitter.com/TheHackerWire/status/2037267104022606334 · Twitter Post
• https://twitter.com/CVEnew/status/2037280595571859778 · Twitter Post