HALO version 2.13.1 has an insecure cross-origin resource sharing setting that allows an arbitrary origin.