CVE-2026-78079: CWE-601 URL Redirection to Untrusted Site ('Open Redirect') in joomshaper.com Helix Ultimate extension for Joomla

The Helix Ultimate extension for Joomla (versions 1.0 to 2.2.9) contains an open redirect vulnerability (CWE-601) due to improper validation of Base64-encoded return redirect parameters. The extension fails to verify whether the resolved redirect target is an internal site URL using Uri::isInternal, allowing attackers to craft URLs that redirect users to arbitrary external sites. This can be exploited to facilitate phishing or redirect users to malicious domains.

Successful exploitation allows attackers to redirect users to arbitrary external websites, potentially facilitating phishing attacks or other social engineering. There is no indication of privilege escalation or direct code execution. The vulnerability requires user interaction (UI:P) and has low vector complexity (AC:L).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently provided. Until a fix is available, users should be cautious about untrusted redirect parameters and consider disabling or restricting the use of the vulnerable redirect functionality if possible.