CVE-2026-91772

Executive Summary

CVE-2026-91772 is an open redirect vulnerability (CWE-601) in Halo, an open-source Java-based content management and blogging platform, affecting versions through 2.26.1. The flaw resides in the anonymous (unauthenticated) thumbnail endpoint, which fails to validate the uri query parameter, allowing any remote attacker to construct a link on a trusted Halo domain that redirects victims to an arbitrary external site. Because the redirect originates from the legitimate Halo host, the vulnerability undermines domain-based trust, enabling credential-phishing lures and abuse of redirect-based allowlisting; CVSS 3.1 scores it 6.1 (Medium), driven by network reachability, no privileges required, user interaction required, and a Scope change (S:C).

Technical Analysis

The vulnerability is an unvalidated redirect (CWE-601) in Halo's thumbnail-handling API. Per the NVD description, the endpoint in question is anonymous — i.e., reachable without authentication — and accepts a uri query parameter that is not validated before being used as a redirect destination. The result is that a request to a Halo instance can be answered with an HTTP redirect (or client-side navigation) to an attacker-controlled external URL.

Key technical properties derivable from the provided data:

• Attack vector / reachability: AV:N — the endpoint is network-exposed. Halo instances are typically published directly to the internet as public websites or intranets, so the vulnerable endpoint inherits whatever exposure the deployment has.
• Authentication: PR:N — the anonymous designation confirms no credentials or session are required to trigger the redirect behavior.
• User interaction: UI:R — exploitation requires a victim to follow the crafted link (the redirect target is only reached when someone requests the URL).
• Scope: S:C — the security impact crosses a trust boundary. The vulnerable component (Halo) is used as a conduit to affect a resource outside its intended scope (the victim's interaction with a third-party site), which is the canonical scoring rationale for open redirects that subvert domain trust.
• Confidentiality / Integrity: C:L / I:L — low impact. An open redirect itself does not disclose or modify data on the Halo server; the low CIA ratings reflect secondary effects of the phishing chain it enables.
• Availability: A:N — no availability impact.

The root cause is a missing or insufficient allowlist/denylist on the redirect destination. The flaw class is well understood: user-supplied input controls an HTTP redirect target without constraining it to same-origin or an approved set of hosts. The description does not provide the endpoint path, parameter-handling code, framework method, or validation logic — no additional implementation detail is asserted here to avoid fabrication. It is accurate to state that the flaw is reachable anonymously via a query parameter named uri on the thumbnail endpoint, and that no validation of that parameter prevents external redirection.

The affected range "through 2.26.1" means all releases up to and including 2.26.1 are presumed vulnerable. No fixed version is confirmed.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available for this CVE at the time of writing; the attack chain below is inferred from the vulnerability class (CWE-601) and the NVD description only. No specific function names, file paths, or internal code patterns are asserted.

1. Reconnaissance / target identification. An attacker identifies internet-facing Halo instances (e.g., via Shodan using a Halo-related title/HTML/favicon fingerprint) and confirms the thumbnail endpoint responds anonymously and honors the uri parameter as a redirect target.

2. Triggering the flaw class. The attacker crafts a URL pointing at the victim's trusted Halo host, supplying the uri query parameter with an arbitrary external destination (for example, a look-alike credential-harvesting page). Because the endpoint performs no validation of uri, the Halo host issues a redirect to the attacker-chosen destination.

3. Payload / delivery. The crafted link is distributed via email, messaging platforms, or social media. The visible domain in the link is the trusted Halo domain, which defeats naive "check the domain" scrutiny and any email gateway or browser allowlist that trusts the Halo origin. No malicious code executes on the Halo server — the endpoint is abused purely as a redirector.

4. Post-exploitation impact. Victims land on the attacker-controlled site. Typical outcomes: credential phishing (a fake login page mimicking a trusted service), malware delivery landing pages, OAuth/SSO flow manipulation, or laundering of malicious links through a reputable domain to bypass reputation-based filtering. The Halo instance itself is not compromised, which makes the abuse difficult to attribute and easy to repeat.

Exploitation is low-complexity (AC:L) and requires no privileges (PR:N) but does depend on a victim clicking the link (UI:R), which bounds the practical severity to the reported 6.1.

Impact Assessment

• Confidentiality (C:L): No direct data exposure on the Halo server; the low rating reflects potential credential capture on the attacker's landing page.
• Integrity (I:L): No modification of Halo-hosted content; the low rating reflects the integrity of the user's session/trust being redirected to attacker infrastructure.
• Availability (A:N): No availability impact.
• Scope (S:C): The defining characteristic — trust in the Halo origin is weaponized against resources outside Halo's security scope.
• Blast radius: Every anonymous visitor who can be induced to click a crafted link on a vulnerable Halo deployment. Organizations that publish Halo as a public-facing site or that allowlist the Halo domain in mail/web filters inherit elevated risk.
• Business impact: Reputational damage from brand-trust abuse, increased phishing success rates, bypass of domain-reputation controls, and potential downstream account compromise if harvested credentials are reused. EPSS is 0.00183 (~8.2nd percentile), indicating low current exploitation likelihood in the wild; CISA KEV status is NO. No threat-actor campaign is associated in the provided data.

Detection Guidance

Because the redirect is a normal HTTP transaction to the Halo host, detection focuses on observing requests to the anonymous thumbnail endpoint that carry an external destination in the uri parameter, and on correlating those requests with outbound redirection.

Sigma Rule

title: Halo Thumbnail Endpoint Open Redirect Attempt (CVE-2026-91772)
id: 5b2f9c1e-9177-4e2a-9d3f-halo91772a01
status: experimental
description: Detects requests to the Halo anonymous thumbnail endpoint carrying a uri parameter that points to an external host, indicating CVE-2026-91772 open redirect abuse.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91772
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains:
      - '/thumbnail'
      - '/apis/api.halo.run'
  selection_param:
    cs-uri-query|contains: 'uri='
  selection_external:
    cs-uri-query|contains:
      - 'uri=http://'
      - 'uri=https://'
      - 'uri=//'
  filter_self:
    cs-uri-query|contains:
      - 'uri=/'
  condition: selection_endpoint and selection_param and selection_external and not filter_self
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - cs(User-Agent)
falsepositives:
  - Legitimate same-origin thumbnail requests using absolute internal URLs
level: medium

YARA Rule

rule CVE_2026_91772_Halo_OpenRedirect_Request
{
    meta:
        description = "Detects HTTP request artifacts referencing the Halo thumbnail endpoint with an external uri parameter (CVE-2026-91772 open redirect)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91772"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $ep1 = "thumbnail" ascii nocase
        $ep2 = "/apis/api.halo.run" ascii nocase
        $p1  = "uri=http://" ascii nocase
        $p2  = "uri=https://" ascii nocase
        $p3  = "uri=//" ascii nocase
        $ua  = "User-Agent" ascii nocase

    condition:
        (any of ($ep1, $ep2)) and (any of ($p1, $p2, $p3)) and $ua
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-91772 Halo Thumbnail Endpoint Open Redirect Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"uri="; nocase; http.uri; pcre:"/uri=(https?:)?\/\//i"; http.uri; content:"thumbnail"; nocase; classtype:web-application-attack; reference:cve,2026-91772; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91772; sid:20269177; rev:1;)

Note: adjust the endpoint match (thumbnail) to the observed deployment path; the uri= external-scheme match is the core detection primitive.

Elastic Detection

sequence by source.ip with maxspan=1m
  [http where http.request.method == "GET" and
      http.request.uri : "*uri=*" and
      (http.request.uri : "*uri=http://*" or
       http.request.uri : "*uri=https://*" or
       http.request.uri : "*uri=//*")]

This matches HTTP GET requests whose URI carries an external destination in the uri parameter, the hallmark of the CVE-2026-91772 redirect abuse.

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx:access
| eval uri=urldecode(uri)
| where match(uri, "uri=(https?:)?//")
| rex field=uri "uri=(?<redirect_target>(https?:)?//[^\s&\"]+)"
| stats count min(_time) as first_seen max(_time) as last_seen values(redirect_target) as targets by src_ip, uri_path
| where count >= 1
| sort - count

This surfaces requests containing an external uri parameter and extracts the redirect destination for triage. Tune the index/sourcetype to your Halo access-log source and add uri_path filters matching the thumbnail endpoint.

Wazuh OSSEC Rule

<group name="web,halo,cve-2026-91772,">
  <rule id="100917" level="10">
    <if_sid>31100</if_sid>
    <id>^GET</id>
    <url>uri=(https?:)?//</url>
    <description>CVE-2026-91772: Possible Halo thumbnail endpoint open redirect (external uri parameter)</description>
    <mitre>
      <id>T1566</id>
    </mitre>
    <group>web_attack,</group>
  </rule>
</group>

Adjust if_sid to match your web access-log decoder parent rule (e.g., the parent rule for your Apache/Nginx decoder) and confirm the <url> match field is populated by that decoder.

Mitigation & Patch Guidance

Patch confidence is 2/4 (CLAIMED) — a single source (OSV) claims a fix exists, but this is not independently confirmed. No patched version number, commit hash, or vendor advisory is available, and the affected-version list is empty/unfixed at the package level. Treat patch status as unverified and validate with the Halo project before relying on it.

1. Immediate mitigations (no patch required):

• Deploy the detection rules above to monitor the anonymous thumbnail endpoint for external uri parameter values.
• At the reverse proxy / WAF in front of Halo, block or reject requests where the uri query parameter resolves to an external host (scheme http://, https://, or protocol-relative //).
• Remove the Halo domain from any redirect allowlists or trusted-domain configurations in email/web filtering.
• Add user-facing warnings and phishing-awareness guidance noting that legitimate Halo links do not redirect off-domain via the thumbnail endpoint.
• If the thumbnail feature is not required, disable or restrict access to the anonymous thumbnail endpoint via proxy rules until a verified fix is applied.

2. Patch / upgrade steps:

• Check the official Halo project release notes and repository for a version above 2.26.1 that explicitly addresses the unvalidated uri parameter.
• Because patch confirmation is single-source and incomplete, do not treat any upgrade as authoritative until release notes or a commit reference confirms the fix.
• After upgrading, re-test the endpoint with an external uri value to confirm the redirect is now blocked or restricted to same-origin destinations.

3. Long-term hardening:

• Implement server-side allowlisting of redirect destinations: only same-origin or explicitly approved hosts should be valid uri values, rejecting everything else by default.
• Apply a deny-by-default redirect policy across all endpoints that accept destination parameters, not just the thumbnail endpoint.
• Add regression tests (unit/integration) that assert external redirects are rejected for any parameter controlling navigation.
• Monitor for additional instances of this class in other Halo endpoints and plugins.

References

• NVD — CVE-2026-91772: https://nvd.nist.gov/vuln/detail/CVE-2026-91772
• CWE-601 — URL Redirection to Untrusted Site ("Open Redirect"): https://cwe.mitre.org/data/definitions/601.html
• OSV — advisory entry claiming a patch (single source; unconfirmed): https://osv.dev/ (search CVE-2026-91772)
• Halo project repository / release notes (verify patched version above 2.26.1): https://github.com/halo-dev/halo
• CISA Known Exploited Vulnerabilities catalog (status: not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploit-in-the-wild evidence: None. EPSS 0.00183 (~8.2nd percentile), no public PoC/exploit code, no Nuclei template, and no CISA KEV listing. No threat-actor campaign is associated with this CVE in the provided data. The attack chain described in this report is inferred from the vulnerability class and NVD description; it is not corroborated by observed exploitation.