CVE-2025-40846
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2025
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
HaloITSM open redirect via the returnUrl
Improper Input Validation, the returnUrl parameter in Account Security Settings lacks proper input validation, allowing attackers to redirect users to malicious websites (Open Redirect) and inject JavaScript code to perform cross site scripting attack. The vulnerability affects Halo versions up to 2.174.101 and all versions between 2.175.1 and 2.184.21
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
ITSM
- Vendor
- HaloITSM
- Product
- ITSM
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| >= 2.174.101 | unaffected | patch | Unavailable | Unavailable | None listed |
| >= 2.184.21 | unaffected | Any version | Unavailable | Unavailable | None listed |