CVE-2026-128045
OpenMage Magento-LTS before 20.18.2 Authorization Bypass via Forgeable RSS Order Key
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
OpenMage Magento-LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an authorization bypass in the /rss/order/status feed because its URL key is unsigned Base64-encoded JSON of the order, increment, and customer ids. Unauthenticated attackers can forge keys from enumerated sequential ids to read other customers' names, items, prices, totals, and status comments when order-status RSS is enabled.
| CWE | CWE-639 |
| Vendor | openmage |
| Product | magento-lts |
| Published | Nov 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for openmage magento-lts
Be the first to know when new medium vulnerabilities affecting openmage magento-lts are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
OpenMage / magento-lts
0 < 20.18.2
OpenMage / magento-lts
21.0.0-beta1 < 21.0.0-beta3
References
github.com: https://github.com/OpenMage/magento-lts/security/advisories/GHSA-3hh8-xg45-mwrr github.com: https://github.com/OpenMage/magento-lts/commit/fde2d109292944d705c4035d87df055b1e945ea3 vulncheck.com: https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-authorization-bypass-via-forgeable-rss-order-key
Credits
🔍 bruhdev1290 colinmollenhour Hanmac