CVE-2026-91772Medium· 6.1▾ TwilightPoC availableHalo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query parameter. Attackers can craft malicious links on the trusted Halo domain that redirect visitors to arbi…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 33.6 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Exploit / PoC code exists
Last analysed / modified upstream
0.2% → 0.3%
Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query parameter. Attackers can craft malicious links on the trusted Halo domain that redirect visitors to arbitrary external sites, enabling phishing attacks and abuse of redirect-based trust relationships.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-97182High· 7.3A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1
CVE-2026-116117High· 7.3halo-dev halo View Name Resolver DefaultViewNameResolver.java path traversal
CVE-2025-14117Medium· 4.3A vulnerability has been found in fit2cloud Halo 2.21.10
CVE-2025-15141Low· 3.1A vulnerability was determined in Halo up to 2.21.10
CVE-2026-115537Medium· 4.3gedelumbung HospitalManagement URL Validation routing_pages.php simpan redirect
CVE-2026-112251Medium· 4.3antoinersx clawhost Reverse Proxy reverseProxy.ts handleRequest redirect