CVE-2026-91772
- Source
- https://cve.org/CVERecord?id=CVE-2026-91772
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91772.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-91772
- Published
- 2026-09-15T01:20:33Z
- Modified
- 2026-09-25T08:09:05Z
- Severity
-
- 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N CVSS Calculator
- Summary
- Halo through 2.26.1 Open Redirect via Unvalidated URI Parameter
- Details
-
Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query parameter. Attackers can craft malicious links on the trusted Halo domain that redirect visitors to arbitrary external sites, enabling phishing attacks and abuse of redirect-based trust relationships.
- Database specific
{ "cna_assigner": "VulnCheck", "cwe_ids": [ "CWE-601" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91772.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91772.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-91772
- https://www.vulncheck.com/advisories/halo-through-2.26.1-open-redirect-via-unvalidated-uri-parameter
- https://github.com/halo-dev/halo/issues/10247
- https://github.com/halo-dev/halo
- https://github.com/halo-dev/halo/blob/v2.26.1/application/src/main/java/run/halo/app/core/endpoint/theme/ThumbnailEndpoint.java#L76-L98
- https://github.com/halo-dev/halo/blob/v2.26.1/application/src/main/resources/extensions/role-template-anonymous.yaml#L53-L55
Affected packages
Git / github.com/halo-dev/halo
Affected ranges
- Type
- GIT
- Repo
- https://github.com/halo-dev/halo
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "introduced": "0" }, { "last_affected": "2.26.1" }, { "fixed": "2.26.1" } ], "source": [ "AFFECTED_FIELD", "DESCRIPTION" ] }
Affected versions
v0.*
v0.0.1
v0.0.2
v0.0.3
v0.0.4
v0.0.5
v0.0.6
v0.0.7
v0.0.8
v0.0.9
v0.1
v0.1.1
v0.2.0
v0.2.1
v0.3.0
v0.4.0
v0.4.1
v1.*
v1.0.0
v1.0.1
v1.0.2
v1.0.3
v1.1.0
v1.1.1
v1.2.0
v1.3.0
v1.3.0-beta.1
v1.3.0-beta.2
v1.3.0-beta.3
v1.3.0-beta.4
v1.3.1
v1.3.2
v1.4.0
v1.4.0-beta.1
v1.4.0-beta.2
v1.4.0-beta.3
v1.4.1
v1.4.11
v1.4.12
v1.4.13
v1.4.2
v1.4.3
v1.4.3-beta.1
v1.4.3-beta.2
v1.4.3-beta.3
v1.4.4
v1.4.5
v1.4.6
v1.4.7
v1.4.7-beta.1
v1.4.8
v1.4.9
v1.5.0-alpha.1
v2.*
v2.0.0
v2.0.0-alpha.1
v2.0.0-alpha.2
v2.0.0-alpha.3
v2.0.0-alpha.4
v2.0.0-beta.1
v2.0.0-beta.2
v2.0.0-rc.1
v2.0.0-rc.2
v2.1.0
v2.1.0-rc.1
v2.10.0
v2.10.0-alpha.1
v2.10.0-beta.1
v2.11.0
v2.11.0-rc.1
v2.11.0-rc.2
v2.12.0
v2.12.0-alpha.1
v2.12.0-alpha.2
v2.12.0-beta.1
v2.12.0-beta.2
v2.12.0-rc.1
v2.12.0-rc.2
v2.12.3
v2.13.0
v2.13.0-rc.1
v2.14.0
v2.14.0-rc.1
v2.15.0
v2.15.0-rc.1
v2.16.0
v2.16.0-rc.1
v2.16.0-rc.2
v2.17.0
v2.17.0-alpha.1
v2.17.0-alpha.2
v2.17.0-beta.1
v2.17.0-rc.1
v2.18.0
v2.18.0-rc.1
v2.19.0
v2.19.0-rc.1
v2.19.0-rc.2
v2.19.0-rc.3
v2.19.0-rc.4
v2.2.0
v2.20.0
v2.20.0-rc.1
v2.20.0-rc.2
v2.20.1
v2.20.10
v2.20.11
v2.20.12
v2.20.13
v2.20.14
v2.20.15
v2.20.16
v2.20.17
v2.20.18
v2.20.19
v2.20.2
v2.20.20
v2.20.21
v2.20.3
v2.20.4
v2.20.5
v2.20.6
v2.20.7
v2.20.8
v2.20.9
v2.21.0
v2.21.0-alpha.1
v2.21.0-alpha.2
v2.21.0-beta.1
v2.21.0-beta.2
v2.21.1
v2.21.2
v2.21.3
v2.21.4
v2.21.5
v2.21.6
v2.21.7
v2.21.8
v2.21.9
v2.22.0
v2.22.0-alpha.1
v2.22.0-alpha.2
v2.22.0-alpha.3
v2.22.0-alpha.4
v2.22.0-rc.1
v2.22.1
v2.22.10
v2.22.11
v2.22.2
v2.22.3
v2.22.4
v2.22.5
v2.22.6
v2.22.7
v2.22.8
v2.22.9
v2.23.0
v2.23.0-beta.1
v2.23.0-beta.2
v2.23.1
v2.23.2
v2.24.0
v2.24.1
v2.24.2
v2.25.0
v2.25.0-beta.1
v2.25.0-beta.2
v2.25.1
v2.25.2
v2.25.3
v2.25.4
v2.26.0
v2.26.0-beta.1
v2.26.0-beta.2
v2.26.0-beta.3
v2.3.0
v2.3.0-rc.1
v2.4.0
v2.4.0-rc.1
v2.5.0
v2.5.0-rc.1
v2.5.0-rc.2
v2.5.1
v2.6.0
v2.6.0-rc.1
v2.7.0
v2.7.0-rc.1
v2.7.0-rc.2
v2.8.0
v2.8.0-rc.1
v2.8.0-rc.2
v2.9.0
v2.9.0-rc.1
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91772.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"166855948397904678103112474001187415800",
"118517037054621016515246765890427914072",
"195457363847359597083094171205036903003",
"224848528698756094740901327098727165309",
"283393648080333598372012606794697049520",
"236348070274883809667097415511024568022",
"226845985895713663723284932908681364130",
"311149303485528184833479854982320563134",
"39568372487139204665212831325328124264",
"275490974234972039010248687824658841226",
"324597203796799843097824516586485904926",
"117345975946047174688202603232007147149",
"334252489208379643464063327835252983374",
"52411519495482715764667387245805782963"
],
"threshold": 0.9
},
"id": "CVE-2026-91772-9a1e400e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/halo-dev/halo/commit/88c2ef14355c79a4dbd1d5c3246b3ea32836e06b",
"target": {
"file": "application/src/test/java/run/halo/app/core/reconciler/PluginReconcilerTest.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "241275643593736170166702228213220464358",
"length": 2890
},
"id": "CVE-2026-91772-cad3c346",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/halo-dev/halo/commit/88c2ef14355c79a4dbd1d5c3246b3ea32836e06b",
"target": {
"file": "application/src/main/java/run/halo/app/core/reconciler/PluginReconciler.java",
"function": "loadOrReload"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "265989160307302484927426312053291156588",
"length": 234
},
"id": "CVE-2026-91772-d10690c3",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/halo-dev/halo/commit/88c2ef14355c79a4dbd1d5c3246b3ea32836e06b",
"target": {
"file": "application/src/test/java/run/halo/app/core/reconciler/PluginReconcilerTest.java",
"function": "setUp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "194065642635000353690384152114066277384",
"length": 3542
},
"id": "CVE-2026-91772-da0080e4",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/halo-dev/halo/commit/88c2ef14355c79a4dbd1d5c3246b3ea32836e06b",
"target": {
"file": "application/src/main/java/run/halo/app/core/reconciler/PluginReconciler.java",
"function": "enablePlugin"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"301381563776612969342084214891742736110",
"171130132708040216699532027824588269522",
"84424102573194305852747138707079011205",
"183467525196979873011674225841952583164",
"284332428043675193981115043033967254969",
"199971809224488376574852724573452760328",
"162596580153136615362590500373587918914",
"267008319559917445390647540925280075100",
"139767248680030564070781128289074664716",
"251910497642204996659131296969688008913",
"149165404765612833904578893644758777831",
"190167266381730927013359142173139635661",
"188985181374254991514257168637647047861",
"41036776523283444665679279204349718246",
"105127971790569729673882524813515352386",
"255697962552352410379636666821965864304",
"275110985111663135207693860271742244517",
"321248982135525115396764871891120998766",
"229988091923802058714999679105161200329",
"114227998846866228477331022675981953894",
"279836683970287267522139548131220175054"
],
"threshold": 0.9
},
"id": "CVE-2026-91772-e8ad7d7e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/halo-dev/halo/commit/88c2ef14355c79a4dbd1d5c3246b3ea32836e06b",
"target": {
"file": "application/src/main/java/run/halo/app/core/reconciler/PluginReconciler.java"
}
}
]
vanir_signatures_modified
"2026-09-25T08:09:05Z"