GHSA-92fr-9r7v-rw2xCriticalCVSS 9.0
OpenMage Magento LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a cross-site...
🔗 CVE IDs covered (1)
📋 Description
OpenMage Magento LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a cross-site request forgery vulnerability in the admin and storefront OAuth confirm and confirmSimple actions, which accept GET requests without form-key validation. Attackers holding OAuth consumer credentials can lure a logged-in administrator or customer to a crafted confirm URL that authorizes the attacker's request token, then exchange it at /oauth/token for a persistent REST API access token bound to the victim.
🔗 References (5)
- https://github.com/OpenMage/magento-lts/security/advisories/GHSA-grrq-9gq2-vm55
- https://nvd.nist.gov/vuln/detail/CVE-2026-128049
- https://github.com/OpenMage/magento-lts/commit/1f83e49b60e08aa7ba89dcc2d41ea21f62c0b796
- https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-csrf-via-oauth-authorization-confirm
- https://github.com/advisories/GHSA-92fr-9r7v-rw2x