CVE-2026-128049

Name of the Vulnerable Software and Affected Versions OpenMage Magento LTS versions prior to 20.18.2 OpenMage Magento LTS versions 21.0.0-beta1 through 21.0.0-beta2

Description A cross-site request forgery issue exists in the admin and storefront OAuth confirm and confirmSimple actions. These actions accept GET requests without validating the form-key variable. An attacker possessing OAuth consumer credentials can trick an authenticated administrator or customer into visiting a specially crafted URL. This action authorizes the attacker's request token, which can then be exchanged at the '/oauth/token' endpoint for a persistent REST API access token linked to the victim's account.

Recommendations Update OpenMage Magento LTS to version 20.18.2 or later. Update OpenMage Magento LTS to version 21.0.0-beta3 or later.