CVE-2026-128030 · Package
NO FIX YET · SEE WHAT TO DO
OpenMage magento-lts does not check whether an API user is still active when renewing a SOAP or XML-RPC session, and REST OAuth does not check whether the admin user is active. An attacker holding an existing session or OAuth token keeps API access after the user is deactivated or keys are rotated, and can read and change customer, order and catalog data.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Stores running OpenMage magento-lts (a Magento 1 fork) that expose the SOAP/XML-RPC API or REST OAuth integrations. Exposure depends on whether API users or integration tokens are ever deactivated or rotated, since that is when the flaw lets old access persist. Sites without API integrations can skip it.
Not affected if api-disabled, managed-hosting, no-soap-or-oauth-integrations
Who cares e-commerce, magento, openmage, php, self-hosted
20.18.2 (stable line) and 21.0.0-beta3 (beta line)20.18.2 or later on the 20.x line21.0.0-beta3 or laterOpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an insufficient session expiration vulnerability because Mage_Api_Model_Session::_renewBySessId() never checks api_user.is_active and REST OAuth authorization never checks whether the admin user is active. Attackers holding an existing SOAP/XML-RPC session or OAuth access token retain API access after deactivation or API key rotation, reading and modifying customer, order and catalog data.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.