CVE-2026-128043 · Package
NO FIX YET · SEE WHAT TO DO
OpenMage magento-lts has a cross-site request forgery flaw in its PayPal cancel and decline return handlers, which trust the checkout session without checking the request came from PayPal. An attacker who lures a shopper to a crafted link can cancel the shopper's recent uninvoiced order, void pending authorizations, and restore items to the cart.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Stores running OpenMage magento-lts with the PayPal Standard payment method, where a shopper's session can be targeted by a crafted cross-site link. Stores on the fixed versions or without PayPal Standard are not affected. The sources do not say whether a specific setting is needed beyond the PayPal module being in use.
Not affected if fixed-version, no-paypal-standard
Who cares e-commerce, magento-lts, openmage, paypal, php
20.19.0 or later on the 20.x line21.0.0-beta3 or laterOpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains a cross-site request forgery vulnerability in PayPal cancel and decline return handlers that trust only the checkout session without verifying the request came from PayPal. Attackers can lure a shopper into a cross-site GET to paypal/standard/cancel to cancel their recent uninvoiced order, void pending authorizations, and restore items to the cart.
This page as .md ·
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.