CVE-2026-128049 · Package
NO FIX YET · SEE WHAT TO DO
OpenMage Magento's admin and storefront OAuth confirm actions accept GET requests without form-key validation, so a crafted link can authorize an attacker's OAuth request token. The attacker then exchanges it for a persistent REST API token bound to a logged-in administrator or customer.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running OpenMage Magento LTS before 20.18.2 or the 21.0.0-beta line before 21.0.0-beta3 with OAuth enabled are exposed. The attack needs OAuth consumer credentials and a logged-in administrator or customer who opens a crafted link. Sites on the fixed versions, or with OAuth unused, can skip it.
Not affected if fixed-version, oauth-unused
Who cares magento, oauth, openmage, self-hosted
OAuth confirm routes (confirm and confirmSimple) in the admin and storefront that accept GET requests.20.18.2 or later.21.0.0-beta3 or later.OpenMage Magento LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a cross-site request forgery vulnerability in the admin and storefront OAuth confirm and confirmSimple actions, which accept GET requests without form-key validation. Attackers holding OAuth consumer credentials can lure a logged-in administrator or customer to a crafted confirm URL that authorizes the attacker's request token, then exchange it at /oauth/token for a persistent REST API access token bound to the victim.
This page as ·
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.