CVE-2026-91772: Halo through 2.26.1 Open Redirect via Unvalidated URI Parameter
Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query parameter. Attackers can craft malicious links on the trusted Halo domain that redirect visitors to arbitrary external sites, enabling phishing attacks and abuse of redirect-based trust relationships.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Haloto a version that resolves this vulnerability.Fixed in 2.26.1 - Configuration
Update Halo to a version that fixes the open redirect in the anonymous thumbnail endpoint by validating the uri query parameter so it cannot redirect to arbitrary external sites.
Halo anonymous thumbnail endpoint uri query parameter validation = validated
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker can craft a malicious link using the anonymous thumbnail endpoint. Exploitation requires convincing a visitor to follow that link.
Are default or public-facing deployments affected?
The affected endpoint is described as anonymous, so deployments that expose Halo's anonymous thumbnail endpoint may be susceptible without requiring the attacker to authenticate.
What is the practical impact?
The trusted Halo domain can be used to redirect visitors to an arbitrary external site. This can support phishing and bypasses of trust relationships that allow or rely on redirects from the Halo domain.