Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:LSummary
CVE-2026-33506 is a high-severity Improper Neutralization of Alternate XSS Syntax (CWE-87) vulnerability in Ory Polis. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Content Injection (T1659); ranked at the 38th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-33506 is a DOM-based Cross-Site Scripting (XSS) vulnerability affecting Ory Polis, formerly known as BoxyHQ Jackson, a tool that bridges or proxies SAML login flows to OAuth 2.0 or OpenID Connect. Versions prior to 26.2.0 improperly trust a URL parameter called `callbackUrl`, which is passed directly to `router.push` in the login functionality. This flaw, linked to CWE-87 (Improper Neutralization of Alternate XSS Syntax) and CWE-601 (URL Redirection to Untrusted Site), carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L), indicating high severity due to its network accessibility, low attack complexity, lack of required privileges, user interaction dependency, and scope change with high confidentiality impact.
An attacker can exploit this vulnerability by crafting a malicious link containing a tainted `callbackUrl`. When an authenticated user—or an unauthenticated user who later logs in—opens the link in their browser, it triggers a client-side redirect and executes arbitrary JavaScript in the victim's browser context. Potential outcomes include theft of user credentials, pivoting to internal networks, and performing unauthorized actions on the victim's behalf, such as session hijacking or data exfiltration.
The Ory Polis GitHub security advisory (GHSA-3wjr-6gw8-9j22) and release notes for version 26.2.0 detail the patch, which addresses the improper handling of the `callbackUrl` parameter to prevent XSS execution. Security practitioners should upgrade to version 26.2.0 or later and review deployments for exposure of login endpoints.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-16320
Vulnerability Data
Ory Polis, formerly known as BoxyHQ Jackson, bridges or proxies a SAML login flow to OAuth 2.0 or OpenID Connect. Versions prior to 26.2.0 contain a DOM-based Cross-Site Scripting (XSS) vulnerability in Ory Polis's login functionality. The application improperly trusts…
more
a URL parameter (`callbackUrl`), which is passed to `router.push`. An attacker can craft a malicious link that, when opened by an authenticated user (or an unauthenticated user that later logs in), performs a client-side redirect and executes arbitrary JavaScript in the context of their browser. This could lead to credential theft, internal network pivoting, and unauthorized actions performed on behalf of the victim. Version 26.2.0 contains a patch for the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V3.7.2
Mitigating Controls (NIST 800-53 r5) AI
SA-11 requires developer testing and analysis that can discover improper neutralization of alternate script syntax after it has been coded.
SI-10 directly requires validation/sanitization of untrusted inputs, which structurally stops alternate XSS syntax from reaching the interpreter.
Information flow enforcement can restrict redirects to only approved/trusted destinations, stopping untrusted user-supplied URLs from being followed.
SA-8 mandates secure engineering principles such as input neutralization and output encoding that prevent introduction of this class of flaw.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require proper input neutralization and output encoding to prevent alternate XSS syntax.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure coding standards require proper neutralization of alternate script syntax, directly eliminating CWE-87.
Security testing catches residual XSS but does not itself implement the neutralization controls.
Preventing access to attacker-controlled or malicious sites stops users from being redirected to untrusted locations via open-redirect or phishing links.
Secure SDLC mandates input validation and output encoding that directly prevent alternate XSS syntax.
Application security requirements explicitly call for neutralization of untrusted input to block XSS variants.
Secure architecture principles reduce attack surface but do not prescribe specific encoding rules.