Cross-Site Request Forgery in OpenMage Magento LTS by OpenMage
CVE-2026-128049

9.4CRITICAL

Key Information:

Vendor

Openmage

Status
Magento-lts
Vendor
CVE Published:
13 November 2026

What is CVE-2026-128049?

OpenMage Magento LTS versions prior to 20.18.2 and 21.0.0-beta1 (before 21.0.0-beta3) reveal a serious Cross-Site Request Forgery (CSRF) vulnerability within the admin and storefront OAuth confirm actions. This flaw permits attackers with OAuth consumer credentials to mislead an authenticated administrator or customer into clicking on a malicious confirm URL. If successful, this action grants the attacker’s request token authorization and allows them to obtain a persistent REST API access token linked to the victim, thereby compromising the system's integrity.

Affected Version(s)

magento-lts 0 < 20.18.2

magento-lts 21.0.0-beta1 < 21.0.0-beta3

magento-lts 20.18.2

References

https://github.com/OpenMage/magento-lts/security/advisori...
vendor-advisory
https://github.com/OpenMage/magento-lts/commit/1f83e49b60...
patch
https://www.vulncheck.com/advisories/openmage-magento-lts...
third-party-advisory

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

C-Brown
Abhi-Hackz
colinmollenhour
theroch
Hanmac
.