TI-2025-27278 CVE-2025-40846 · GHSA-mcvh-54mc-g3ggHaloITSM open redirect via the returnUrlPriority LOW 31Improper Input Validation, the returnUrl parameter in Account Security Settings lacks proper input validation, allowing attackers to redirect users to malicious websites (Open Redirect) and inject JavaScript code to perf…CVSS 4.0HIGH 7.1· Network · Low privileges · User interaction · EPSS 0.00359 · Published 2025-05-08 · Fixed in >= 2.174.101, >= 2.184.21 CWE-20
