CVE-2026-75114 MEDIUM

CVE-2026-75114: Joomla Extension - yootheme.com - Open redirect in CommentController::twitterAuthenticate() in Zoo < 4.1.64

Vendor Yootheme.com

Product Zoo extension for Joomla

Weakness CWE-601 · Open redirect

Published August 19, 2026

Last update August 21, 2026

View on NVD All CVEs

CVSS base score

5.1/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction —

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

What the vulnerability does

01Description

Joomla Extension - yootheme.com - Open redirect in CommentController::twitterAuthenticate() in Zoo < 4.1.64 - The referer request parameter is passed straight to setRedirect() with no validation.

Explanation of Vulnerability in Simple Terms

02Summary

The Zoo extension for Joomla contains an open redirect vulnerability that allows an attacker to redirect users to an external website. An attacker can craft a malicious link containing an untrusted URL and trick a user into clicking it. The extension fails to properly validate redirect destinations before sending users away from the site.

What an attacker can do

03Attacker Capabilities

Redirect site visitors to a malicious external website by crafting a specially crafted link.

Potential impact on your site

04Site Impact

Site visitors can be redirected to phishing or malware sites, damaging your site's reputation and exposing users to harm.

Conditions required to exploit

05Prerequisites

User must click a malicious link (user interaction required). No authentication needed.

Key dates

06Disclosure timeline

August 19, 2026 CVE published

August 21, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-75114 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/601.html AskarLabs — CWE-601 write-up URL Redirection to Untrusted Site (Open Redirect)

Related vulnerabilities