CVE-2026-33506

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-33506
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33506.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-33506
Aliases
  • GHSA-3wjr-6gw8-9j22
Published
2026-03-26T18:48:15Z
Modified
2026-08-12T03:51:36Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L CVSS Calculator
Summary
DOM-Based XSS in Ory Polis Login Page
Details

Ory Polis, formerly known as BoxyHQ Jackson, bridges or proxies a SAML login flow to OAuth 2.0 or OpenID Connect. Versions prior to 26.2.0 contain a DOM-based Cross-Site Scripting (XSS) vulnerability in Ory Polis's login functionality. The application improperly trusts a URL parameter (callbackUrl), which is passed to router.push. An attacker can craft a malicious link that, when opened by an authenticated user (or an unauthenticated user that later logs in), performs a client-side redirect and executes arbitrary JavaScript in the context of their browser. This could lead to credential theft, internal network pivoting, and unauthorized actions performed on behalf of the victim. Version 26.2.0 contains a patch for the issue.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-601",
        "CWE-87"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33506.json"
}
References

Affected packages

Git / github.com/ory/polis

Affected ranges

Type
GIT
Repo
https://github.com/ory/polis
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
73bd08d197dd107e41769d95b8cfc654fa86cd66
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:ory:polis:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "26.2.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.2.2
v0.3.0
v0.3.2
v0.3.3
v0.3.5
v0.3.6
v0.3.8
v0.4.0
v0.4.1
v0.4.2
v0.4.3
v0.5.0
v0.5.1
v1.*
v1.0.0
v1.0.1
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.1.0
v1.1.1
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.6
v1.10.0
v1.10.1
v1.11.0
v1.11.1
v1.11.2
v1.11.3
v1.12.0
v1.12.1
v1.12.2
v1.13.0
v1.13.2
v1.13.3
v1.14.0
v1.14.1
v1.14.2
v1.14.3
v1.15.0
v1.15.1
v1.15.2
v1.15.3
v1.15.4
v1.15.5
v1.15.6
v1.16.0
v1.16.1
v1.16.2
v1.17.0
v1.17.1
v1.17.2
v1.18.0
v1.18.1
v1.18.2
v1.18.3
v1.18.4
v1.18.5
v1.18.6
v1.18.7
v1.18.8
v1.18.9
v1.19.0
v1.19.1
v1.19.2
v1.2.1
v1.2.2
v1.20.0
v1.20.1
v1.20.2
v1.20.3
v1.20.4
v1.20.5
v1.20.6
v1.21.0
v1.21.1
v1.21.2
v1.21.3
v1.21.4
v1.21.5
v1.21.6
v1.21.7
v1.21.8
v1.21.9
v1.22.0
v1.22.1
v1.23.0
v1.23.1
v1.23.10
v1.23.2
v1.23.3
v1.23.4
v1.23.5
v1.23.6
v1.23.7
v1.23.8
v1.23.9
v1.24.0
v1.24.1
v1.24.2
v1.25.0
v1.25.1
v1.26.0
v1.26.1
v1.26.2
v1.26.3
v1.26.4
v1.26.5
v1.26.6
v1.26.7
v1.26.8
v1.27.0
v1.27.1
v1.27.2
v1.28.0
v1.28.1
v1.28.2
v1.29.0
v1.3.0
v1.3.1
v1.3.10
v1.3.11
v1.3.12
v1.3.2
v1.3.3
v1.3.4
v1.3.5
v1.3.6
v1.3.7
v1.3.8
v1.3.9
v1.30.0
v1.31.0
v1.32.0
v1.33.0
v1.33.1
v1.34.0
v1.34.1
v1.34.2
v1.34.3
v1.34.4
v1.34.5
v1.34.6
v1.34.7
v1.35.0
v1.35.1
v1.36.0
v1.37.0
v1.37.1
v1.38.0
v1.39.0
v1.39.1
v1.39.2
v1.39.3
v1.4.0
v1.40.0
v1.40.1
v1.40.2
v1.41.0
v1.41.1
v1.41.2
v1.42.0
v1.43.0
v1.44.0
v1.45.0
v1.45.1
v1.45.2
v1.45.3
v1.46.0
v1.47.0
v1.48.0
v1.48.1
v1.48.2
v1.49.0
v1.5.0
v1.5.1
v1.50.0
v1.51.0
v1.52.0
v1.52.1
v1.52.2
v1.6.0
v1.7.0
v1.7.1
v1.7.2
v1.7.3
v1.7.4
v1.7.5
v1.7.6
v1.8.0
v1.8.1
v1.9.0
v1.9.1
v1.9.10
v1.9.11
v1.9.2
v1.9.3
v1.9.4
v1.9.5
v1.9.6
v1.9.7
v1.9.8
v1.9.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33506.json"