CVE-2026-128032
Received Received - Intake

OpenMage Magento-LTS Free Payment Method Bypass

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 accepts the free (No Payment Information Required) payment method on orders with a non-zero total because the zero-total check runs only when payment data is imported. An API user with cart permissions can select free via cart_payment.method while the total is zero, raise it with cart_coupon.remove, and submit cart.order to place an unpaid full-price order.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-128032
EUVD
EUVD-2026-125070

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
openmage magento_lts to 20.18.2 (exc)
openmage magento_lts to 21.0.0-beta3 (exc)
openmage magento-lts to 20.18.2 (exc)
openmage magento-lts to 21.0.0-beta3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-841 The product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an API user with cart permissions to bypass payment by exploiting a flaw in OpenMage Magento-LTS. The system fails to validate zero-total orders properly, enabling users to select a free payment method even when the order total is non-zero. The attacker can manipulate the cart total using coupons and submit an unpaid order.

Impact Analysis

This vulnerability could lead to financial losses as unpaid orders are processed. Businesses using OpenMage Magento-LTS may face revenue theft, fraudulent transactions, and potential disruption of services due to unpaid orders being fulfilled.

Mitigation Strategies

Upgrade OpenMage Magento-LTS to version 20.18.2 or later, or 21.0.0-beta3 or later to address the payment method validation issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-128032. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...