CVE-2026-75114: Joomla Extension - yootheme.com - Open redirect in CommentController::twitterAuthenticate() in Zoo < 4.1.64
Published Aug 19, 2026
·Updated
Joomla Extension - yootheme.com - Open redirect in CommentController::twitterAuthenticate() in Zoo < 4.1.64 - The referer request parameter is passed straight to setRedirect() with no validation.
Affected Software
1 affected component
yootheme.com Joomla extension - Zoo<4.1.64
Event History
Aug 19, 2026
CVE Published
via MITRE·01:39 PM
Data Sourced
via MITRE·01:39 PM
DescriptionWeakness
Frequently Asked Questions
1
What input enables the redirect, and what validation is missing?
The issue is triggered through the referer request parameter in CommentController::twitterAuthenticate(). That value is passed directly to setRedirect() without validation.
2
Which versions are identified as affected?
Zoo versions earlier than 4.1.64 are identified as affected. The provided data does not state whether version 4.1.64 or later contains a fix.