CVE-2026-75114 describes an open redirect vulnerability in the yootheme.com Zoo extension for Joomla, affecting versions from 1.0.0 up to and including 4.1.63. The flaw is due to the referer parameter being used directly in the setRedirect() method within the CommentController::twitterAuthenticate() function without any validation, enabling potential redirection to untrusted URLs. This vulnerability is classified under CWE-601 and has a CVSS 4.0 base score of 5.1, indicating medium severity. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

The vulnerability allows attackers to craft URLs that redirect users to arbitrary external sites, which could be used in phishing attacks or to redirect users to malicious websites. However, it does not directly allow code execution or data compromise within the Joomla extension itself. The impact is limited to user redirection to untrusted sites.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when handling URLs involving the referer parameter in the affected versions. Consider implementing manual validation or filtering of redirect parameters as a temporary mitigation.