CVE-2026-128042: OpenMage magento-lts before 20.19.0 Race Condition in Coupon Usage Limits
OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains a race condition in shopping cart price rule usage limits, because MageSalesRuleModelValidator checks coupon limits without locking and the usage counters are later incremented non-atomically. Unauthenticated attackers, including guest shoppers, can submit concurrent checkouts to redeem a limited coupon more times than its cap allows.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
OpenMage magento-lts versions before 20.19.0 are affected. The 21.0.0 beta line is affected through 21.0.0-beta2; 21.0.0-beta3 is the first listed unaffected beta release.
Does exploitation require an account or special permissions?
No. Unauthenticated attackers, including guest shoppers, can exploit the issue by submitting concurrent checkout requests using a limited coupon.
What must an attacker do to exceed a coupon's usage cap?
The attacker must race multiple checkout attempts concurrently. The vulnerability exists because coupon limits are checked without locking and usage counters are incremented non-atomically.