CVE-2026-128044: OpenMage magento-lts before 20.18.2 OAuth Callback URL Allowlist Bypass
OpenMage magento-lts before 20.18.2 and 21.x before 21.0.0-beta3 validates OAuth 1.0a oauthcallback URLs with a string-prefix check and falls back to accepting any well-formed URL. Attackers holding a leaked consumer key and secret can supply host-suffix, userinfo, or arbitrary callback URLs to capture an approving administrator's or customer's request token and verifier, then obtain an access token with the victim's API privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenMage magento-ltsto a version that resolves this vulnerability.Fixed in 20.18.2 - Upgrade
Upgrade
OpenMage magento-ltsto a version that resolves this vulnerability.Fixed in 21.0.0-beta3
Event History
Frequently Asked Questions
Which deployments are affected?
OpenMage magento-lts versions before 20.18.2 are affected, as are 21.x versions before 21.0.0-beta3.
What does an attacker need to exploit this issue?
The attacker needs a leaked OAuth consumer key and consumer secret, and must induce an administrator or customer to approve an OAuth authorization request. Exploitation also requires crafting a callback URL that is well formed but bypasses the intended allowlist validation.
What access could an attacker obtain?
An attacker can capture the approving user's OAuth request token and verifier, then exchange them for an access token carrying that victim's API privileges. This can affect both administrator and customer accounts that approve the request.