CVE-2026-91772

EUVD-2026-78248
Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query parameter. Attackers can craft malicious links on the trusted Halo domain that redirect visitors to arbitrary external sites, enabling phishing attacks and abuse of redirect-based trust relationships.
Open Redirect
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.1 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/halo-dev/halo
https://github.com/halo-dev/halo/blob/v2.26.1/application/src/main/java/run/halo/app/core/endpoint/theme/ThumbnailEndpoint.java#L76-L98
https://github.com/halo-dev/halo/blob/v2.26.1/application/src/main/resources/extensions/role-template-anonymous.yaml#L53-L55
https://github.com/halo-dev/halo/issues/10247
https://www.vulncheck.com/advisories/halo-through-2.26.1-open-redirect-via-unvalidated-uri-parameter