CVE-2026-128043: OpenMage magento-lts before 20.19.0 CSRF via PayPal Cancel Return Handlers
OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains a cross-site request forgery vulnerability in PayPal cancel and decline return handlers that trust only the checkout session without verifying the request came from PayPal. Attackers can lure a shopper into a cross-site GET to paypal/standard/cancel to cancel their recent uninvoiced order, void pending authorizations, and restore items to the cart.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Shoppers with a recent uninvoiced order using the affected PayPal checkout flow are exposed if they can be lured into making a cross-site GET request while their checkout session is active.
What does an attacker need to exploit it?
The attacker does not need privileges, but exploitation requires user interaction: they must induce a shopper to visit or trigger a cross-site request to the PayPal standard cancel endpoint. The attack complexity is rated high.
What is the practical impact of a successful attack?
A successful request can cancel the shopper's recent uninvoiced order, void pending payment authorizations, and return the order's items to the shopping cart.
Which releases need remediation?
Affected releases are OpenMage magento-lts versions before 20.19.0 and 21.0.0-beta1 through before 21.0.0-beta3. Updating to 20.19.0 or 21.0.0-beta3 addresses the affected version ranges.