CVE-2026-91772 in Halo
Summary
by MITRE • 09/15/2026
Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query parameter. Attackers can craft malicious links on the trusted Halo domain that redirect visitors to arbitrary external sites, enabling phishing attacks and abuse of redirect-based trust relationships.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/15/2026
The software Halo version 2.26.1 is affected by an open redirect vulnerability located within its anonymous thumbnail endpoint. This security flaw stems from a failure in input validation logic where the application does not adequately sanitize or verify the uri query parameter provided by the client. In web applications, endpoints that handle redirection are common targets for attackers seeking to manipulate user navigation paths. When such parameters are accepted without rigorous checks against an allowlist of trusted domains or proper encoding mechanisms, the server may blindly redirect users to a destination specified entirely by the attacker. This specific implementation error allows any arbitrary Uniform Resource Identifier to be processed as a valid redirect target, bypassing standard security controls designed to keep users within the intended application context.
The operational impact of this vulnerability is primarily centered around social engineering and phishing campaigns rather than direct data exfiltration or system compromise. By exploiting this flaw, an attacker can construct malicious URLs that appear to originate from the legitimate Halo domain because the initial part of the URL remains valid while the redirect destination points elsewhere. When a victim clicks such a link, their browser is redirected away from the trusted site without warning in many configurations, leading them to a fraudulent website controlled by the adversary. This abuse of trust relationships significantly increases the success rate of phishing attacks, as users are more likely to enter credentials or sensitive information on sites that appear to be linked from a reputable source they already recognize and trust.
From a classification perspective, this vulnerability aligns with CWE-601, which defines URL Redirection to Untrusted Site (Open Redirect). This category encompasses flaws where an application redirects users to URLs provided by the user without proper validation, leading to potential phishing or malware distribution. In terms of offensive security frameworks, this technique is associated with ATT&CK Tactic TA0005 Defense Evasion and specifically Technique T1189 Drive-by Compromise if used in conjunction with malicious payloads on the landing page, or more broadly as part of social engineering tactics under TA0001 Initial Access. The lack of validation represents a fundamental oversight in secure coding practices regarding user-supplied input that influences control flow decisions like redirections.
To mitigate this vulnerability, developers must implement strict allowlisting for redirect destinations rather than relying on blacklist approaches which are prone to bypasses through encoding tricks or protocol variations such as http versus https or the use of relative paths. Input validation should ensure that the uri parameter matches a predefined set of trusted domains before processing the redirection request. Additionally, implementing Content Security Policy headers can help mitigate some downstream effects by restricting where frames and redirects can load content from, although direct server-side validation remains the primary defense. Regular security testing including dynamic application security scanning focused on open redirect patterns is recommended to identify similar flaws in other endpoints that handle user-controlled navigation parameters.