CVE-2026-75114: Joomla Zoo Extension Open Redirect Flaw

CVE-2026-75114 Overview

CVE-2026-75114 is an open redirect vulnerability in the YOOtheme Zoo extension for Joomla, affecting versions prior to 4.1.64. The flaw resides in the CommentController::twitterAuthenticate() method, where the referer request parameter is passed directly to setRedirect() without validation. Attackers can craft URLs that appear to originate from a trusted Joomla site but redirect victims to attacker-controlled destinations. This weakness is tracked as CWE-601: URL Redirection to Untrusted Site and is commonly abused for phishing and credential theft campaigns.

Critical Impact
Attackers can leverage the trusted Joomla domain to redirect users to malicious sites, facilitating phishing and malware distribution against site visitors.

Affected Products

YOOtheme Zoo extension for Joomla, versions prior to 4.1.64
Joomla installations using the Zoo component with Twitter authentication enabled
Sites exposing the CommentController endpoint publicly

Discovery Timeline

2026-08-19 - CVE-2026-75114 published to the National Vulnerability Database (NVD)
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-75114

Vulnerability Analysis

The vulnerability exists in the Zoo extension's comment authentication flow. When a user initiates Twitter authentication through the comment system, the controller reads the referer HTTP request parameter to determine where to send the user after processing. The CommentController::twitterAuthenticate() method forwards this value directly to Joomla's setRedirect() function without checking whether the target is a same-origin URL or a whitelisted host.

An attacker crafts a link pointing to the vulnerable Joomla site with a referer parameter set to an external malicious URL. The victim clicks a link that displays the trusted domain in the browser. After the request executes, the server responds with an HTTP redirect to the attacker's destination. The victim's browser follows the redirect, landing on a phishing or malware-delivery page while trusting the initial domain.

Root Cause

The root cause is missing input validation on user-controlled redirect targets. The referer parameter is treated as trusted data even though it originates from the query string or form submission. No allowlist, host comparison, or relative-path enforcement is applied before invoking setRedirect().

Attack Vector

Exploitation is remote and requires user interaction. An attacker distributes a crafted link through email, social media, or messaging platforms. The URL points to the legitimate Joomla site running Zoo, so URL-preview tools and cautious users see a trusted domain. When the victim clicks the link, the vulnerable endpoint issues a redirect to the attacker-controlled host. Refer to the YOOtheme website for vendor information and updates.

Detection Methods for CVE-2026-75114

Indicators of Compromise

HTTP requests to Zoo comment endpoints containing a referer parameter with an absolute external URL
Web server logs showing 30x redirect responses from CommentController to non-local hosts
Referrer chains in downstream phishing infrastructure originating from the Joomla domain

Detection Strategies

Inspect access logs for requests to twitterAuthenticate handlers containing referer=http or referer=// values pointing off-domain
Deploy web application firewall (WAF) rules that flag redirect parameters containing external hostnames or protocol-relative URLs
Correlate outbound redirect events with threat intelligence feeds to identify redirect chains ending at known phishing infrastructure

Monitoring Recommendations

Enable verbose HTTP logging on Joomla web servers to capture full query strings and referer values
Route web server and WAF telemetry to a centralized analytics platform for pattern analysis across sessions
Alert on spikes in 30x responses originating from Zoo comment endpoints

How to Mitigate CVE-2026-75114

Immediate Actions Required

Upgrade the YOOtheme Zoo extension to version 4.1.64 or later on all Joomla installations
Audit web server logs for prior exploitation attempts using the referer parameter against Zoo endpoints
Notify users if suspicious redirect activity is detected and rotate any credentials that may have been captured through phishing

Patch Information

The vendor addressed the issue in Zoo version 4.1.64 by validating the referer parameter before invoking setRedirect(). Administrators should download the latest release from the YOOtheme website and apply the update through the Joomla extension manager.

Workarounds

Restrict access to the Zoo comment authentication endpoints via WAF rules until the patch is applied
Add server-side rewrite rules that reject requests containing absolute URLs in the referer parameter
Disable Twitter authentication in the Zoo configuration if the feature is not required

bash

# Example WAF rule (ModSecurity) to block external redirect targets
SecRule ARGS:referer "@rx ^(https?:)?//" \
    "id:1075114,phase:2,deny,status:400,\
    msg:'CVE-2026-75114: External redirect target blocked'"