Insufficient Session Expiration in OpenMage Magento-LTS Affects API Access

CVE-2026-128030

What is CVE-2026-128030?

OpenMage Magento-LTS prior to version 20.18.2 and the beta versions leading up to 21.0.0-beta3 exhibit an insufficient session expiration vulnerability. This issue arises because the system does not check the status of the API user (api_user.is_active) during session renewals, allowing attackers who possess a valid SOAP/XML-RPC session or OAuth access token to maintain API access. Consequently, they can read and modify sensitive customer, order, and catalog data even after the administrator has deactivated the user or rotated the API keys.

References