CVE-2026-91772 Details
Description
Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query parameter. Attackers can craft malicious links on the trusted Halo domain that redirect visitors to arbitrary external sites, enabling phishing attacks and abuse of redirect-based trust relationships.
An open redirect vulnerability has been identified in Halo versions through 2.26.1. The issue resides in the anonymous thumbnail endpoint, which does not properly validate the 'uri' query parameter. This flaw allows attackers to create malicious links that, when clicked, redirect users to arbitrary external sites. Such a vulnerability could be exploited for phishing attacks or to misuse trust relationships based on redirects.
It is recommended to validate the 'uri' parameter before processing the request. Ensure that the URI is either a relative path within the application or matches the same origin as the configured Halo external URL. If the URI points to an unregistered external host, return a 400 Bad Request response.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 15, 2026CISA-ADP
Assessed Sep 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/halo-dev/halo/issues/10247 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/halo-dev/halo | [email protected] | Vendor |
| https://github.com/halo-dev/halo/blob/v2.26.1/application/src/main/java/run/halo/app/core/endpoint/theme/ThumbnailEndpoint.java#L76-L98 | [email protected] | Source CodeVendor |
| https://github.com/halo-dev/halo/blob/v2.26.1/application/src/main/resources/extensions/role-template-anonymous.yaml#L53-L55 | [email protected] | Source CodeVendor |
| https://github.com/halo-dev/halo/issues/10247 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/halo-through-2.26.1-open-redirect-via-unvalidated-uri-parameter | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Halo | <= 2.26.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 16, 2026 | CVE Modified | CISA-ADP |
| Sep 15, 2026 | New CVE Received | [email protected] |