CVE-2026-128032: OpenMage magento-lts before 20.18.2 Payment Bypass via Free Payment Method
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 accepts the free (No Payment Information Required) payment method on orders with a non-zero total because the zero-total check runs only when payment data is imported. An API user with cart permissions can select free via cartpayment.method while the total is zero, raise it with cartcoupon.remove, and submit cart.order to place an unpaid full-price order.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenMage magento-ltsto a version that resolves this vulnerability.Fixed in 20.18.2 - Upgrade
Upgrade
OpenMage magento-ltsto a version that resolves this vulnerability.Fixed in 21.0.0-beta3
Event History
Frequently Asked Questions
Who can exploit this issue?
An API user with cart permissions can exploit it. The attack requires the user to select the free payment method while the cart total is zero, then remove a coupon to raise the total before submitting the order.
Which releases are affected and which releases contain the fix?
Affected releases are magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3. Updating to 20.18.2 or 21.0.0-beta3 addresses the issue.
How can I determine whether an unpaid order may have been created through this flaw?
Review API-created orders that use the "No Payment Information Required" payment method and have a non-zero order total. The relevant sequence is selection of the free method while the total was zero, followed by coupon removal and order submission.