A DOM-based Cross-Site Scripting vulnerability in Ory Polis allows unauthenticated attackers to execute arbitrary JavaScript, potentially leading to session hijacking and unauthorized user actions.

The application is susceptible to DOM-based XSS because it improperly trusts the callbackUrl parameter, which is passed to router.push. This flaw allows an attacker to craft a malicious link that executes arbitrary JavaScript in the context of the victim browser.

Successful exploitation of this vulnerability poses a significant risk to user security and organizational integrity. By executing arbitrary code in the user context, an attacker could steal sensitive session credentials, conduct phishing attacks, or perform unauthorized actions on behalf of the victim. Given the CVSS score of 8.8, this vulnerability is classified as High severity and requires prompt attention to prevent potential account takeovers.

Immediate Action: Update Ory Polis to version 26.2.0 or later to apply the necessary security patches.

Proactive Monitoring: Monitor web server access logs for anomalous requests containing suspicious callbackUrl parameters or encoded JavaScript payloads.

Compensating Controls: Implement a Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) to filter malicious inputs from incoming URLs.

Public Exploit Available: No

The vulnerability in Ory Polis represents a significant security risk that could facilitate widespread account compromise. Administrators should prioritize upgrading to version 26.2.0 immediately to remediate the underlying DOM-based XSS flaw. Failure to patch may expose users to malicious redirects and credential theft, undermining the security of the authentication proxy service.