CVE-2026-128044
Received Received - Intake

OAuth 1.0a Callback Validation Bypass in OpenMage Magento-LTS

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
OpenMage magento-lts before 20.18.2 and 21.x before 21.0.0-beta3 validates OAuth 1.0a oauth_callback URLs with a string-prefix check and falls back to accepting any well-formed URL. Attackers holding a leaked consumer key and secret can supply host-suffix, userinfo, or arbitrary callback URLs to capture an approving administrator's or customer's request token and verifier, then obtain an access token with the victim's API privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-128044
EUVD
EUVD-2026-125064

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
openmage magento_lts to 20.18.2 (exc)
openmage magento_lts From 21.0.0-beta3 (inc)
openmage magento_lts to 21.0.0-beta3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-346 The product does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in OpenMage magento-lts before 20.18.2 and 21.x before 21.0.0-beta3 involves improper validation of OAuth 1.0a callback URLs. The system used a weak string-prefix check for callback URLs and defaulted to accepting any well-formed URL if the check failed. Attackers with a leaked consumer key and secret could manipulate callback URLs to include host-suffix, userinfo, or arbitrary components, redirecting OAuth tokens to malicious hosts. This allowed them to capture request tokens and verifiers, then obtain access tokens with the victim's API privileges.

Detection Guidance

Check OpenMage Magento-LTS versions before 20.18.2 or 21.x before 21.0.0-beta3 using commands like 'composer show openmage/magento-lts' or 'grep -r "Mage_Oauth_Helper_Data" app/code/core/'. Inspect OAuth callback URL validation in Mage_Oauth_Helper_Data.php for prefix-based checks.

Impact Analysis

Attackers could gain unauthorized access to sensitive data and perform actions on behalf of the victim, such as modifying settings, accessing customer information, or making purchases. The impact includes potential privilege escalation and data breaches. The vulnerability requires the attacker to have a leaked consumer key and secret, as well as a victim to approve the authorization request.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage due to potential data breaches and unauthorized data exposure.

Mitigation Strategies

Upgrade OpenMage Magento-LTS to version 20.18.2 or later. If upgrading is not possible, implement stricter callback URL validation by modifying Mage_Oauth_Helper_Data.php to enforce exact matches for scheme, host, port, and path. Rotate consumer keys and secrets.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-128044. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...