---
id: CVE-2026-91772
title: >-
  Halo through 2.26.1 contains an open redirect vulnerability in the anonymous
  thumbnail endpoint that fails to validate the uri query parameter
summary: >-
  Halo through 2.26.1 contains an open redirect vulnerability in the anonymous
  thumbnail endpoint that fails to validate the uri query parameter. Attackers
  can craft malicious links on the trusted Halo domain that redirect visitors to
  arbi…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-601
vendor: halo-dev
product: halo
affected:
  - halo <= 2.26.1
published: '2026-09-15'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T17:17:47.860'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-91772'
references:
  - url: 'https://github.com/halo-dev/halo'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/halo-dev/halo/blob/v2.26.1/application/src/main/java/run/halo/app/core/endpoint/theme/ThumbnailEndpoint.java#L76-L98
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/halo-dev/halo/blob/v2.26.1/application/src/main/resources/extensions/role-template-anonymous.yaml#L53-L55
    label: disclosure@vulncheck.com
  - url: 'https://github.com/halo-dev/halo/issues/10247'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/halo-through-2.26.1-open-redirect-via-unvalidated-uri-parameter
    label: disclosure@vulncheck.com
  - url: 'https://github.com/halo-dev/halo/issues/10247'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.0032
epssPercentile: 0.22384
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-16T16:56:20.882562Z'
ingestedAt: '2026-09-15T02:19:07.442Z'
---

## Overview

Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query parameter. Attackers can craft malicious links on the trusted Halo domain that redirect visitors to arbitrary external sites, enabling phishing attacks and abuse of redirect-based trust relationships.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.