Vulnerability · Published Sep 15, 2026 · Assigned by VulnCheck
CVE-2026-91772Halo through 2.26.1 Open Redirect via Unvalidated URI Parameter
Medium 6.1
In plain English
A medium-severity open redirect in halo from halo-dev. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.3%top 74.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query parameter. Attackers can craft malicious links on the trusted Halo domain that redirect visitors to arbitrary external sites, enabling phishing attacks and abuse of redirect-based trust relationships.
Affected products (as reported)
Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- https://github.com/halo-dev/halo/issues/10247 issue-tracking
- https://github.com/halo-dev/halo/blob/v2.26.1/application/src/main/java/run/halo/app/core/endpoint/theme/ThumbnailEndpoint.java#L76-L98 technical-description
- https://github.com/halo-dev/halo/blob/v2.26.1/application/src/main/resources/extensions/role-template-anonymous.yaml#L53-L55 technical-description
- https://github.com/halo-dev/halo product
- VulnCheck Advisory: Halo through 2.26.1 Open Redirect via Unvalidated URI Parameter third-party-advisory