CVE-2026-75114 is an open redirect vulnerability in the yootheme.com Zoo extension for Joomla, affecting versions 1.0.0 through 4.1.63. The flaw is located in the CommentController::twitterAuthenticate() method where the referer parameter from the request is used directly in a redirect call without any validation or sanitization. This can allow an attacker to craft URLs that redirect users to arbitrary external sites, potentially facilitating phishing or other social engineering attacks.

The vulnerability allows attackers to redirect users to untrusted external websites via manipulated referer parameters. While this does not directly compromise the Joomla site or user data, it can be used to trick users into visiting malicious sites, increasing the risk of phishing or malware exposure. The CVSS score of 5.1 reflects a medium impact with no required privileges and user interaction needed.

No official patch or fix is currently documented for this vulnerability. Users of the yootheme.com Zoo extension for Joomla versions 1.0.0 through 4.1.63 should monitor vendor advisories for updates. Until a fix is available, consider implementing web application firewall (WAF) rules to detect and block suspicious redirect attempts or validate and sanitize the referer parameter at the application level.