CVE-2026-128044 · Runtime
NO FIX YET · SEE WHAT TO DO
OpenMage magento-lts validates OAuth 1.0a callback URLs with a string-prefix check that falls back to accepting any well-formed URL. An attacker holding a leaked consumer key and secret can redirect an approving admin's or customer's request token and verifier to their own server and obtain an access token with the victim's API privileges.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Stores and sites running OpenMage magento-lts or an older Magento-based install that use OAuth 1.0a API integrations. The exposure requires a leaked consumer key and secret, so teams that never issued OAuth credentials outside the organisation are less exposed. unknown whether sources describe any other preconditions.
Not affected if no-leaked-consumer-keys, oauth-not-used, versions-patched
Who cares magento, magento-lts, oauth, openmage, php, self-hosted
20.18.2 on the 20.x line or below 21.0.0-beta3 on the 21.x line.20.18.221.0.0-beta3OpenMage magento-lts before 20.18.2 and 21.x before 21.0.0-beta3 validates OAuth 1.0a oauth_callback URLs with a string-prefix check and falls back to accepting any well-formed URL. Attackers holding a leaked consumer key and secret can supply host-suffix, userinfo, or arbitrary callback URLs to capture an approving administrator's or customer's request token and verifier, then obtain an access token with the victim's API privileges.
This page as .md ·
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.