CVE-2026-67362 Overview
CVE-2026-67362 is an open redirect vulnerability in the J2Store extension for Joomla, developed by J2Commerce. The flaw affects the cart controller in J2Store versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5. Four task handlers accept a base64-encoded URL from user input and redirect to it without validating the destination host. Attackers exploit the shop's trusted domain to stage phishing campaigns against customers. Exploitation requires no authentication, only that a user follow a crafted link. The weakness is categorized as [CWE-601] URL Redirection to Untrusted Site.
Critical Impact
Unauthenticated attackers can craft links on a trusted J2Store shop domain that transparently redirect victims to attacker-controlled phishing pages.
Affected Products
- J2Store for Joomla 1.0.0 through 3.3.20
- J2Store for Joomla 4.0.0 through 4.0.20
- J2Store for Joomla 4.1.0 through 4.1.5
Discovery Timeline
- 2026-08-21 - CVE-2026-67362 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-67362
Vulnerability Analysis
The vulnerability resides in the J2Store cart controller. Four task handlers accept a redirect target supplied through user-controlled input. The target is provided as a base64-encoded URL, which the controller decodes and passes to the redirect routine. The controller does not verify that the decoded destination matches an allow-listed host or the shop's own domain.
Attackers abuse the shop's trusted domain to send victims to arbitrary external sites. Because the initial link points to a legitimate storefront, users and email security filters treat it as trustworthy. The redirect executes server-side, so URL inspection at the initial hop reveals only the shop domain.
The issue does not require authentication or user interaction beyond clicking the crafted URL. The primary impact is credential theft and malware delivery through phishing campaigns that impersonate the shop.
Root Cause
The root cause is missing destination validation in the redirect logic. Base64 encoding of the parameter provides obfuscation but not security. Since the controller trusts the decoded value without host allow-listing or origin comparison, any URL survives the encode-decode step and reaches the redirect call.
Attack Vector
An attacker constructs a URL to a vulnerable J2Store cart task handler and appends a base64-encoded attacker-controlled URL as the redirect parameter. The attacker distributes this URL through email, SMS, or social media. When a victim clicks, the shop responds with an HTTP redirect to the phishing site. The victim's browser displays the shop domain in the initial link and then the attacker's page, which typically mimics the shop's login or checkout flow to harvest credentials or payment data.
See the J2Commerce homepage for vendor product information.
Detection Methods for CVE-2026-67362
Indicators of Compromise
- Web server access logs containing requests to J2Store cart controller task endpoints with unusually long base64-encoded query string parameters.
- HTTP 301, 302, or 303 responses from the shop domain with Location headers pointing to unrelated external hosts.
- Referrer logs on external domains showing traffic originating from J2Store cart controller URLs.
Detection Strategies
- Parse J2Store request logs, base64-decode redirect parameters, and flag decoded values whose host does not match the shop's registered domain.
- Deploy web application firewall (WAF) rules that inspect and decode redirect parameters passed to the cart controller.
- Correlate outbound redirect responses with threat intelligence feeds covering phishing and newly registered domains.
Monitoring Recommendations
- Alert on spikes in cart controller task requests that carry a redirect parameter, especially from external referrers.
- Monitor customer support channels for reports of phishing pages reached through shop links.
- Track outbound Location header values from the storefront and baseline them against expected internal paths.
How to Mitigate CVE-2026-67362
Immediate Actions Required
- Upgrade J2Store to a fixed release above 3.3.20, 4.0.20, or 4.1.5 depending on your branch.
- Audit web server logs for prior exploitation attempts targeting cart controller task handlers with base64-encoded parameters.
- Notify customers of active phishing risk if suspicious redirects are identified in logs.
Patch Information
J2Commerce has addressed the flaw in updated J2Store releases. Refer to the J2Commerce homepage for the current supported release and download the latest package through the Joomla extension update channel.
Workarounds
- Deploy a WAF rule that blocks requests to J2Store cart task handlers when the redirect parameter decodes to an external host.
- Restrict the cart controller redirect logic through a server-side rewrite that strips or overrides the base64 redirect parameter until patching completes.
- Add HTTP response filtering on the reverse proxy to rewrite Location headers pointing outside the shop domain.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
