CVE-2026-128030
Received Received - Intake

Insufficient Session Expiration in OpenMage Magento-LTS

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an insufficient session expiration vulnerability because Mage_Api_Model_Session::_renewBySessId() never checks api_user.is_active and REST OAuth authorization never checks whether the admin user is active. Attackers holding an existing SOAP/XML-RPC session or OAuth access token retain API access after deactivation or API key rotation, reading and modifying customer, order and catalog data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-128030
EUVD
EUVD-2026-125072

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
openmage magento_lts to 20.18.2 (exc)
openmage magento_lts to 21.0.0-beta3 (exc)
openmage magento-lts to 20.18.2 (exc)
openmage magento-lts From 21.0.0-beta1 (inc) to 21.0.0-beta3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-613 According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenMage Magento-LTS versions before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 have an insufficient session expiration vulnerability. The Mage_Api_Model_Session::_renewBySessId() function does not check if the API user is active, and REST OAuth authorization does not verify if the admin user is active. This allows attackers with existing SOAP/XML-RPC sessions or OAuth tokens to retain API access even after deactivation or API key rotation.

Impact Analysis

Attackers can exploit this to retain unauthorized API access after credentials are revoked. This may lead to reading or modifying sensitive data such as customer information, orders, and catalog details. The impact includes potential data breaches, unauthorized transactions, and compromised system integrity.

Compliance Impact

This vulnerability can lead to unauthorized access and data exposure, violating GDPR's data protection principles and HIPAA's security requirements. It may result in non-compliance, legal penalties, and reputational damage due to insufficient session management and access control.

Mitigation Strategies

Upgrade OpenMage magento-lts to version 20.18.2 or later if using the 20.x branch, or to 21.0.0-beta3 or later if using the 21.x beta branch. This addresses the insufficient session expiration issue by properly validating user status during API access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-128030. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...