CVE-2026-128042 · Runtime
NO FIX YET · SEE WHAT TO DO
OpenMage magento-lts checks shopping cart coupon usage limits without a lock, and the usage counters are incremented non-atomically. Concurrent checkouts can redeem a limited coupon more times than its cap allows.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Stores running OpenMage magento-lts with coupon or cart price rules that have a usage limit are exposed. Stores without limited-use coupons, or running a fixed version, can skip it. Unauthenticated guest shoppers can trigger it by submitting concurrent checkouts.
Not affected if fixed-version, no-usage-limited-coupons
Who cares ecommerce, magento-lts, openmage, self-hosted
20.19.0 and 21.0.0-beta1 through 21.0.0-beta2.20.19.0 or later21.0.0-beta3 or laterOpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains a race condition in shopping cart price rule usage limits, because Mage_SalesRule_Model_Validator checks coupon limits without locking and the usage counters are later incremented non-atomically. Unauthenticated attackers, including guest shoppers, can submit concurrent checkouts to redeem a limited coupon more times than its cap allows.
This page as .md ·
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.