CVE-2026-33506
Published: 26 March 2026
Description
Ory Polis, formerly known as BoxyHQ Jackson, bridges or proxies a SAML login flow to OAuth 2.0 or OpenID Connect. Versions prior to 26.2.0 contain a DOM-based Cross-Site Scripting (XSS) vulnerability in Ory Polis's login functionality. The application improperly trusts…
more
a URL parameter (`callbackUrl`), which is passed to `router.push`. An attacker can craft a malicious link that, when opened by an authenticated user (or an unauthenticated user that later logs in), performs a client-side redirect and executes arbitrary JavaScript in the context of their browser. This could lead to credential theft, internal network pivoting, and unauthorized actions performed on behalf of the victim. Version 26.2.0 contains a patch for the issue.
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of untrusted inputs like the callbackUrl parameter to block malicious JavaScript payloads in DOM-based XSS attacks.
Mandates filtering and encoding of outputs prior to insertion into the DOM via router.push, preventing arbitrary JavaScript execution from tainted URLs.
Ensures timely identification, reporting, and patching of the specific flaw in versions prior to 26.2.0 that improperly trusts callbackUrl.
Security SummaryAI
CVE-2026-33506 is a DOM-based Cross-Site Scripting (XSS) vulnerability affecting Ory Polis, formerly known as BoxyHQ Jackson, a tool that bridges or proxies SAML login flows to OAuth 2.0 or OpenID Connect. Versions prior to 26.2.0 improperly trust a URL parameter called `callbackUrl`, which is passed directly to `router.push` in the login functionality. This flaw, linked to CWE-87 (Improper Neutralization of Alternate XSS Syntax) and CWE-601 (URL Redirection to Untrusted Site), carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L), indicating high severity due to its network accessibility, low attack complexity, lack of required privileges, user interaction dependency, and scope change with high confidentiality impact.
An attacker can exploit this vulnerability by crafting a malicious link containing a tainted `callbackUrl`. When an authenticated user—or an unauthenticated user who later logs in—opens the link in their browser, it triggers a client-side redirect and executes arbitrary JavaScript in the victim's browser context. Potential outcomes include theft of user credentials, pivoting to internal networks, and performing unauthorized actions on the victim's behalf, such as session hijacking or data exfiltration.
The Ory Polis GitHub security advisory (GHSA-3wjr-6gw8-9j22) and release notes for version 26.2.0 detail the patch, which addresses the improper handling of the `callbackUrl` parameter to prevent XSS execution. Security practitioners should upgrade to version 26.2.0 or later and review deployments for exposure of login endpoints.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
DOM XSS via untrusted callbackUrl enables arbitrary JS execution in browser on link open (T1189 drive-by, T1059.007 JavaScript) and direct session/cookie theft (T1539).