CVE-2026-128047: OpenMage magento-lts before 20.18.2 Account Takeover via Predictable Confirmation Key
OpenMage magento-lts before 20.18.2 and 21.0.0-beta pre-releases before 21.0.0-beta3 generate customer email-confirmation keys with md5(uniqid()) and customer and administrator password-reset tokens with the non-cryptographic uniqHash(). Unauthenticated attackers can brute-force the roughly 20-bit confirmation key via the unrate-limited confirmAction endpoint to log in as pending customers, or predict administrator reset tokens after recovering generator state.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openmage/magento-ltsto a version that resolves this vulnerability.Fixed in 20.18.2 - Upgrade
Upgrade
openmage/magento-ltsto a version that resolves this vulnerability.Fixed in 21.0.0-beta3
Event History
Frequently Asked Questions
Which deployments are affected?
OpenMage magento-lts versions before 20.18.2 are affected. The 21.0.0 beta line is also affected before 21.0.0-beta3.
What access does an attacker need?
An attacker does not need authentication or user interaction to brute-force confirmation keys through the confirmAction endpoint. Predicting administrator reset tokens requires recovering the state of the token generator.
Are all customer accounts equally exposed?
The direct confirmation-key attack applies to pending customer accounts, allowing an attacker who guesses a key to log in as that customer. Customer and administrator password-reset tokens are also generated with the affected non-cryptographic uniqHash() mechanism.
What makes the confirmation-key attack practical?
The confirmation key has roughly 20 bits of entropy and can be brute-forced through an unrate-limited confirmAction endpoint. This permits repeated unauthenticated guessing attempts without the described rate limiting.