Open Redirect Vulnerability in Halo CMS

Executive Summary

CVE-2026-91772 is an open redirect vulnerability in Halo versions up to 2.26.1. It exists in the anonymous thumbnail endpoint which fails to validate the 'uri' query parameter. Attackers can craft malicious links on the trusted Halo domain that redirect users to arbitrary external websites, enabling phishing attacks or abuse of redirect-based trust relationships.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Halo instance is running version 2.26.1 or earlier. Inspect the anonymous thumbnail endpoint for improper validation of the 'uri' query parameter. Test by sending a crafted request to the endpoint with a malicious URI to observe redirects.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to trick users into visiting malicious websites by redirecting them from a trusted Halo domain. This could lead to phishing attacks, credential theft, or exposure to malware. Since the endpoint is accessible without authentication, all users of affected Halo instances are at risk of being redirected to harmful sites.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling phishing attacks or unauthorized data access. Open redirects may trick users into disclosing sensitive information, violating GDPR's data protection principles. For HIPAA, such redirects could expose protected health information if exploited in healthcare-related deployments.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Halo to a version beyond 2.26.1 where the vulnerability is patched. If upgrading is not immediately possible, restrict access to the thumbnail endpoint or implement server-side validation for the 'uri' parameter to prevent open redirects.

Useful 0 Not Useful 0