UE_USER_CONFIRMED with field substitutions

Why is [cb:userfield field="cb_salutation" /] [firstname] [lastname] not substituted in UE_USER_CONFIRMED?

UE_USER_CONFIRMED is not ran through substitutions. It's the message displayed on the confirmation page when a user uses a confirmation URL.

krileon wrote: It's the message displayed on the confirmation page when a user uses a confirmation URL.

Correct, so how do I get the user's name in there to personalize his experience?

You can't, it doesn't parse through substitutions. That page addresses the user directly so using "You" for example is personalized. Only option is probably to redirect to a custom page of your choosing on the onAfterUserConfirmation trigger using CB Auto Actions and a Redirect action. The triggers variables are as follows.