An attacker can craft a malicious link that sets the callbackUrl query parameter to an arbitrary value. Ory Polis blindly trusts this value and passes it to the client‑side router, which results in a redirect and execution of any JavaScript contained in the URL. This DOM‑based Cross‑Site Scripting exploits improper handling of parameters (CWE‑87) and an open redirect flaw (CWE‑601). When this code runs in the victim’s browser it can steal credentials, pivot within the internal network, or perform unauthorized actions on behalf of the user.

All releases of the Ory Polis identity‑and‑access‑management service before version 26.2.0 are affected. The vulnerability exists in the login component where the callbackUrl parameter is processed. Systems running 26.2.0 or later contain the patch that validates or sanitises the callbackUrl value.

The flaw carries a high CVSS base score of 8.8, indicating a serious client‑side risk. Because the exploit occurs only in the user’s browser and requires the user to click a malicious link, no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, credential theft and lateral movement make it a significant concern. The likely attack vector is a phishing or social‑engineering campaign that delivers a crafted URL to an authenticated or soon‑to‑be authenticated user.