CVE-2026-128047

Name of the Vulnerable Software and Affected Versions OpenMage magento-lts versions prior to 20.18.2 OpenMage magento-lts versions prior to 21.0.0-beta3

Description Customer email-confirmation keys are generated using md5(uniqid()), while customer and administrator password-reset tokens use the non-cryptographic uniqHash() function. Unauthenticated attackers can brute-force the approximately 20-bit confirmation key through the confirmAction endpoint, which lacks rate limiting, to gain access as pending customers. Additionally, administrator reset tokens can be predicted after the generator state is recovered.

Recommendations Update OpenMage magento-lts to version 20.18.2 or later. Update OpenMage magento-lts to version 21.0.0-beta3 or later.