CVE-2026-128047 · Package
NO FIX YET · SEE WHAT TO DO
OpenMage generates customer email-confirmation keys and password-reset tokens with weak, non-cryptographic functions, so the keys can be guessed. An unauthenticated attacker can brute-force a pending customer's confirmation key to log in, or predict an administrator's reset token.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running OpenMage magento-lts before 20.18.2, or 21.0.0-beta pre-releases before 21.0.0-beta3, are exposed because customer confirmation and password-reset tokens are generated with weak functions. The confirmAction endpoint has no rate limit, so brute-forcing is practical. Stores on other platforms or on patched versions can skip it.
Not affected if other-platform, patched-version
Who cares magento, magento-lts, openmage, php, self-hosted
uniqid() and uniqHash() in the customer confirmation and password-reset code paths.20.18.2 or later.21.0.0-beta3 or later.OpenMage magento-lts before 20.18.2 and 21.0.0-beta pre-releases before 21.0.0-beta3 generate customer email-confirmation keys with md5(uniqid()) and customer and administrator password-reset tokens with the non-cryptographic uniqHash(). Unauthenticated attackers can brute-force the roughly 20-bit confirmation key via the unrate-limited confirmAction endpoint to log in as pending customers, or predict administrator reset tokens after recovering generator state.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.