CVE-2026-91772 is an open redirect vulnerability in the halo-dev project's Halo product, affecting versions up to 2.26.1. The issue exists in the anonymous thumbnail endpoint where the uri query parameter is not validated, enabling attackers to create malicious URLs on the legitimate Halo domain that redirect users to untrusted external sites. This flaw can be exploited to conduct phishing attacks by leveraging the trust users place in the Halo domain.

The vulnerability allows attackers to redirect users from a trusted Halo domain to arbitrary external websites. This can be used to facilitate phishing attacks and exploit user trust, potentially leading to credential theft or other malicious outcomes. The CVSS score is 6.1 (medium severity) reflecting the network attack vector, low complexity, no privileges required, user interaction required, and partial impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious when clicking on links from the Halo domain that include the uri query parameter, especially if received from untrusted sources.