CVE-2026-25523: Magento's X-Original-Url header can expose admin url
Impact
The admin url can be discovered without prior knowledge of its location by exploiting the X-Original-Url header on some configurations.
Patches
The bug comes from the Zend library.
Workarounds
Unset the X-Original-Url header in the web server configuration.
Resources
https://hackerone.com/bugs?subject=openmage&reportid=3416312
Upon deeper investigation, it was initially not found, but then it was realized that the search excluded the vendor/ directory. This is coming from the ZendController module. Here is another tip from 2016 - it is surprising that this was not somehow patched already!
https://peterocallaghan.co.uk/2016/12/magento-poisoning-cache/ (dead link now..)
Credit
Anees Hyder (anees0xdev) on HackerOne https://hackerone.com/anees0xdev/hacktivity?type=user
Other sources
Magento-lts is a long-term support alternative to Magento Community Edition (CE). Prior to version 20.16.1, the admin url can be discovered without prior knowledge of it's location by exploiting the X-Original-Url header on some configurations. This issue has been patched in version 20.16.1.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25523?
CVE-2026-25523 has a medium severity level due to its potential for exposing the admin URL of Magento.
How do I fix CVE-2026-25523?
To fix CVE-2026-25523, unset the X-Original-Url header in your configuration.
Which versions of Magento are affected by CVE-2026-25523?
CVE-2026-25523 affects OpenMage Magento versions up to and including 20.16.0.
What impact can CVE-2026-25523 have on my Magento installation?
Exploiting CVE-2026-25523 may allow unauthorized users to discover the admin URL of your Magento installation.
Is there a patch available for CVE-2026-25523?
Yes, a patch is included in version 20.16.1 of OpenMage Magento.