← CVE Radar
CVE-2026-128049OpenMage Magento LTS before 20.18.2 CSRF via OAuth Authorization Confirm
OpenMage Magento LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a cross-site request forgery vulnerability in the admin and storefront OAuth confirm and confirmSimple actions, which accept GET requests without form-key validation. Attackers holding OAuth consumer credentials can lure a logged-in administrator or customer to a crafted confirm URL that authorizes the attacker's request token, then exchange it at /oauth/token for a persistent REST API access token bound to the victim.
9.4 CRITICALNot in KEVNVD: Received
Overview
Severity
| Score | Severity | Version | Technologies Affected |
|---|---|---|---|
| 9.4 | CRITICAL | 4.0VulnCheck (CNA) | OpenMage Magento-Lts |
| 9.0 | CRITICAL | 3.1VulnCheck (CNA) |
Details
- CVE ID
- CVE-2026-128049
- Status
- Received
- Assigner (CNA)
- VulnCheck
- Published
- Nov 13, 2026
- Last modified
- 2026-11-13 10:18 UTC
- Weaknesses
- CWE-352 · Cross-Site Request Forgery (CSRF)
Affected Products
As published by the CNA in the CVE record.
OpenMagemagento-lts1 version range
- before 20.18.2
OpenMagemagento-lts1 version range
- 21.0.0-beta1 before 21.0.0-beta3
References
- github.com https://github.com/OpenMage/magento-lts/commit/1f83e49b60e08aa7ba89dcc2d41ea21f62c0b796
- github.com https://github.com/OpenMage/magento-lts/security/advisories/GHSA-grrq-9gq2-vm55
- vulncheck.com https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-csrf-via-oauth-authorization-confirm