CVE-2026-128049: OpenMage Magento LTS before 20.18.2 CSRF via OAuth Authorization Confirm
OpenMage Magento LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a cross-site request forgery vulnerability in the admin and storefront OAuth confirm and confirmSimple actions, which accept GET requests without form-key validation. Attackers holding OAuth consumer credentials can lure a logged-in administrator or customer to a crafted confirm URL that authorizes the attacker's request token, then exchange it at /oauth/token for a persistent REST API access token bound to the victim.
Affected Software
Event History
Frequently Asked Questions
Which users and deployments are exposed?
Deployments running OpenMage Magento LTS before 20.18.2 or 21.0.0-beta1 before 21.0.0-beta3 are affected. Exploitation targets a logged-in administrator or customer who can be induced to visit a crafted OAuth confirmation URL.
What does an attacker need to exploit this issue?
The attacker needs OAuth consumer credentials and an attacker-controlled request token. They must also lure an authenticated administrator or customer into making a GET request to a crafted confirm or confirmSimple URL.
What access can an attacker obtain after a successful attack?
The attacker can authorize their request token in the victim's context and exchange it at /oauth/token for a persistent REST API access token bound to that victim. The resulting impact depends on the privileges associated with the affected administrator or customer.
How can I determine whether the issue is present?
Check the deployed OpenMage Magento LTS version and whether the OAuth admin or storefront confirm and confirmSimple actions accept GET requests without form-key validation. Versions before 20.18.2, and 21.0.0 beta releases before beta3, are affected.