CVE-2026-91772: Halo Open Redirect Vulnerability

CVE-2026-91772 Overview

CVE-2026-91772 is an open redirect vulnerability [CWE-601] affecting Halo through version 2.26.1, an open-source content management system. The flaw resides in the anonymous thumbnail endpoint, which fails to validate the uri query parameter before issuing an HTTP redirect. Attackers can craft URLs on a trusted Halo domain that redirect visitors to arbitrary external destinations. This behavior enables phishing campaigns and abuse of redirect-based trust relationships with browsers, email gateways, and security scanners that treat the Halo domain as reputable.

Critical Impact
Attackers can weaponize legitimate Halo URLs to redirect users to attacker-controlled phishing pages while preserving the appearance of the trusted origin domain.

Affected Products

Halo versions through 2.26.1
Halo anonymous thumbnail endpoint (ThumbnailEndpoint.java)
Deployments granting the anonymous role template access to the vulnerable route

Discovery Timeline

2026-09-15 - CVE-2026-91772 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-91772

Vulnerability Analysis

Halo exposes an anonymous thumbnail endpoint that accepts a uri query parameter and issues a redirect based on its value. The endpoint does not validate whether the supplied URI targets the local origin or an approved allowlist. As a result, any unauthenticated visitor can request a Halo URL that instructs the server to redirect to an arbitrary external site. Because the initial request originates from the trusted Halo domain, downstream trust decisions by users, email filters, URL scanners, and OAuth flows may be subverted. The referenced source at ThumbnailEndpoint.java lines 76-98 shows the handler that consumes the parameter, and the anonymous role template YAML grants unauthenticated callers access to the route.

Root Cause

The root cause is missing destination validation on the uri query parameter within the thumbnail handler. The endpoint treats attacker-controlled input as a trusted redirect target rather than enforcing an allowlist of same-origin or vetted external URLs.

Attack Vector

An attacker crafts a URL on a legitimate Halo instance that contains an attacker-controlled uri parameter pointing to a phishing site. The attacker distributes the link via email, social media, or messaging platforms. When a victim clicks the link, the Halo server responds with an HTTP redirect that sends the browser to the attacker's destination. Exploitation requires user interaction to click the crafted link. See the VulnCheck Halo Open Redirect Advisory and GitHub Issue #10247 for additional technical context.

No verified proof-of-concept code is published. The exploitation pattern involves appending an attacker-controlled URL to the vulnerable thumbnail endpoint's uri query parameter and observing the redirect response.

Detection Methods for CVE-2026-91772

Indicators of Compromise

Access log entries for the anonymous thumbnail endpoint containing external URLs in the uri query parameter.
HTTP 302 or 301 responses from the Halo thumbnail route pointing to domains outside the site's own origin.
Referrer patterns showing users arriving at unfamiliar external domains directly after visiting a Halo URL.

Detection Strategies

Parse Halo web server access logs and alert on uri parameter values whose host component does not match the configured Halo domain.
Correlate outbound redirects from the Halo domain with newly registered or low-reputation domains using threat intelligence feeds.
Deploy web application firewall (WAF) rules that flag or block requests to the thumbnail endpoint when the uri parameter contains an absolute URL to a foreign host.

Monitoring Recommendations

Ingest Halo access logs into a centralized SIEM and create detections for redirect abuse against the anonymous thumbnail route.
Monitor phishing telemetry and user reports for links that originate from the organization's Halo domain but terminate on external sites.
Track anomalous spikes in traffic to the vulnerable endpoint that may indicate automated abuse in phishing campaigns.

How to Mitigate CVE-2026-91772

Immediate Actions Required

Upgrade Halo to a fixed release once published by the maintainers. Track the Halo GitHub repository and GitHub Issue #10247 for patch availability.
Restrict anonymous access to the vulnerable thumbnail endpoint until a patch is applied.
Educate users and support staff to treat unexpected external redirects originating from the Halo domain as suspicious.

Patch Information

At the time of publication, refer to the Halo repository and the VulnCheck advisory for the latest fixed version and remediation guidance. Administrators should apply the vendor patch as soon as it becomes available and validate that the uri parameter is validated against an allowlist of trusted destinations.

Workarounds

Place a reverse proxy or WAF in front of Halo that blocks requests to the thumbnail endpoint when the uri parameter contains an absolute URL to any host other than the Halo origin.
Modify the anonymous role template (role-template-anonymous.yaml) to revoke access to the vulnerable endpoint for unauthenticated users where feasible.
Rewrite outbound redirects at the proxy layer to an interstitial warning page that requires explicit user confirmation before leaving the Halo domain.

bash

# Example WAF rule concept (ModSecurity-style) to block off-origin redirects
# Adjust HALO_HOST to match your deployment
SecRule REQUEST_URI "@rx /thumbnails?\?.*uri=" \
  "chain,phase:1,deny,status:400,id:1092026,\
   msg:'CVE-2026-91772 - Halo open redirect attempt'"
  SecRule ARGS:uri "!@beginsWith https://HALO_HOST/" "t:none,t:urlDecodeUni"