Halo through 2.26.1 Open Redirect via Unvalidated URI Parameter

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps halo-dev/halo (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for halo-dev/halo.
2. 2Review the reported fix. Monitor this advisory for an available fix and review any installs of the affected package.

Evidence timeline and material changes

1. Published upstream

   Sep 15, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Sep 15, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Sep 15, 2026

Sources and claim methodology

• GitHub security advisorygithub.com
• GitHub security advisorygithub.com
• GitHub security advisorygithub.com
• GitHub security advisorygithub.com
• Source referencevulncheck.com

Related CVEs

• Incomplete Security Scanner Blocklist Enables Network-Based Code ExecutionSame generic ecosystem
• Out-of-bounds write in it51xxx I2C target FIFO ISR on oversized write transactionSame generic ecosystem
• Concrete CMS 8.3.0 to 9.5.2 is vulnerable to Stored XSS in Calendar Event Name via Workflow Approval NotificationsSame generic ecosystem
• On affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authorization, a low-privileged attacker on an adjacent network segment who induces a RADIUS packet through a configured RADISame generic ecosystem
• A brief (milliseconds to seconds) traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all CLI command or due to a supplicant timeout. During this window, the supplicant's traffic may pass without ACL enforcemSame generic ecosystem
• A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. UserSame generic ecosystem