OAuth Callback URL Validation Bypass in OpenMage Magento Product by OpenMage

CVE-2026-128044

What is CVE-2026-128044?

OpenMage Magento versions prior to 20.18.2 and 21.x before 21.0.0-beta3 are susceptible to a vulnerability that permits attackers to circumvent OAuth 1.0a validation of oauth_callback URLs. This vulnerability arises from an inadequate string-prefix check, allowing well-formed URLs that can be managed by an attacker. By exploiting leaked consumer keys and secrets, adversaries can manipulate callback URLs, gaining the ability to capture request tokens and verify them. This can ultimately lead to unauthorized access to endpoints with the victim's API privileges, posing significant risks to sensitive data and systems.

References