CVE-2026-67921

Halo CMS (versions up to 2.25.4 ) is affected by a CSRF/CORS misconfiguration in CorsConfigurer.java and CsrfConfigurer.java. The console API does not validate XSRF tokens, the session cookie uses SameSite=None, and CORS reflects any origin with credentials. This enables a browser-based attack ch...

CVE-2026-67921

Cross-Site Request Forgery CSRF vulnerability exists in Halo CMS versions up to 2.25.4 via the CorsConfigurer.java and the CsrfConfigurer.java components. This allows a remote attacker to execute arbitrary code...