The Hikashop extension for Joomla, versions 1.0.0 up to 6.5.1, contains an open redirect vulnerability identified as CVE-2026-61901. This vulnerability allows attackers to craft URLs that redirect users to untrusted external websites, potentially facilitating phishing or other social engineering attacks. The CVSS 3.1 base score is 6.1, indicating a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality and integrity impacts. There is no vendor advisory or patch information available at this time.

Successful exploitation could lead to users being redirected to malicious websites, which may result in phishing attacks or other social engineering risks. The vulnerability impacts confidentiality and integrity at a low level but does not affect availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with URLs involving the Hikashop extension and consider implementing web application firewall rules to detect and block suspicious redirects.