CVE-2026-14632 describes an open redirect vulnerability in the setReferrer function of the Trusted Backend Interface component within kirilkirkov Ecommerce-CodeIgniter-Bootstrap. The vulnerability arises from improper validation of the href argument, enabling an attacker to redirect users to arbitrary external URLs. The product follows a rolling release model, making explicit affected version identification unavailable. A patch identified by commit 213babdbaa949e94557246414db0130e01394517 has been made to remediate the issue. The vulnerability has a CVSS 4.0 score of 5.3, indicating medium severity, and requires user interaction for exploitation.

Successful exploitation of this vulnerability could allow attackers to redirect users to malicious websites, potentially facilitating phishing attacks or other social engineering exploits. There is no indication of direct code execution or data compromise. The vulnerability requires no privileges and no authentication but does require user interaction.

A patch has been committed (commit 213babdbaa949e94557246414db0130e01394517) to fix the vulnerability. Users of the kirilkirkov Ecommerce-CodeIgniter-Bootstrap project should apply this patch promptly. Since the product uses a rolling release model, users should update to the latest codebase that includes this fix. No additional vendor advisory is available, so check the project repository for the patch and further guidance.