CVE-2026-128030: OpenMage magento-lts before 20.18.2 Insufficient Session Expiration After API User Deactivation
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an insufficient session expiration vulnerability because MageApiModelSession::renewBySessId() never checks apiuser.isactive and REST OAuth authorization never checks whether the admin user is active. Attackers holding an existing SOAP/XML-RPC session or OAuth access token retain API access after deactivation or API key rotation, reading and modifying customer, order and catalog data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenMage magento-ltsto a version that resolves this vulnerability.Fixed in 20.18.2 - Upgrade
Upgrade
OpenMage magento-ltsto a version that resolves this vulnerability.Fixed in 21.0.0-beta3
Event History
Frequently Asked Questions
Which releases address this issue?
The issue is addressed in OpenMage magento-lts 20.18.2 and 21.0.0-beta3. Affected releases are versions before 20.18.2 and 21.0.0-beta1 through before 21.0.0-beta3.
What must an attacker already possess to exploit this?
An attacker needs an existing SOAP/XML-RPC API session or REST OAuth access token. The issue allows that previously issued credential to remain usable after the related API or admin user is deactivated.
Does deactivating an API user or rotating API keys immediately remove existing access?
No. In affected versions, existing SOAP/XML-RPC sessions and OAuth access tokens can retain API access after deactivation or API key rotation, including access to read and modify customer, order, and catalog data.