CVE-2025-40846

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

Improper Input Validation, the returnUrl parameter in Account Security Settings lacks proper input validation, allowing attackers to redirect users to malicious websites (Open Redirect) and inject JavaScript code to perform cross site scripting attack.

The vulnerability affects Halo versions up to 2.174.101 and all versions between 2.175.1 and 2.184.21

Metrics

CVSS 4.0 7.1/10

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:X/RE:L/U:Red

Weakness enumeration

CWE-20 CWE-601

Affected software

No affected versions have been published.

Timeline

Published: May 8, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-40857.1An attacker with control over a content process could potentially leverage the privileged UITour actor to leak sensitive information or esca CVE-2025-40866.5A specially crafted filename containing a large number of encoded newline characters could obscure the file's extension when displayed in th CVE-2025-40874.8A vulnerability was identified in Thunderbird where XPath parsing could trigger undefined behavior due to missing null checks during attribu CVE-2025-40886.5A security vulnerability in Thunderbird allowed malicious sites to use redirects to send credentialed requests to arbitrary endpoints on any CVE-2025-408856.5A SQL Injection vulnerability was discovered in the Smart Polling functionality due to improper validation of an input parameter. An authent CVE-2025-408868.8A SQL Injection vulnerability was discovered in the Alert functionality due to improper validation of an input parameter. An authenticated u CVE-2025-408876.5A SQL Injection vulnerability was discovered in the Alert functionality due to improper validation of an input parameter. An authenticated u CVE-2025-408886.5A SQL Injection vulnerability was discovered in the CLI functionality due to improper validation of an input parameter. An authenticated use CVE-2025-408898.1A path traversal vulnerability was discovered in the Time Machine functionality due to missing validation of two input parameters. An authen CVE-2025-40895.1Due to insufficient escaping of special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, po CVE-2025-408907.9A Stored Cross-Site Scripting vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter.CVE-2025-408914.7A Stored HTML Injection vulnerability was discovered in the Time Machine Snapshot Diff functionality due to improper validation of network t