CVE-2026-128047

OpenMage magento-lts before 20.18.2 Account Takeover via Predictable Confirmation Key

View on CVE.org
Published Nov 13, 2026 CVSS 4.0 · 9.2 Critical EPSS n/a KEV · Not listed
Description
OpenMage magento-lts before 20.18.2 and 21.0.0-beta pre-releases before 21.0.0-beta3 generate customer email-confirmation keys with md5(uniqid()) and customer and administrator password-reset tokens with the non-cryptographic uniqHash(). Unauthenticated attackers can brute-force the roughly 20-bit confirmation key via the unrate-limited confirmAction endpoint to log in as pending customers, or predict administrator reset tokens after recovering generator state.

Analysis

No analysis available yet

Remediation

No remediation available yet

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Description OpenMage magento-lts before 20.18.2 and 21.0.0-beta pre-releases before 21.0.0-beta3 generate customer email-confirmation keys with md5(uniqid()) and customer and administrator password-reset tokens with the non-cryptographic uniqHash(). Unauthenticated attackers can brute-force the roughly 20-bit confirmation key via the unrate-limited confirmAction endpoint to log in as pending customers, or predict administrator reset tokens after recovering generator state.
Title OpenMage magento-lts before 20.18.2 Account Takeover via Predictable Confirmation Key
Weaknesses CWE-330
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

Weaknesses
  • CWE-330

    Use of Insufficiently Random Values

Sources

Status
PUBLISHED
Assigner
VulnCheck
Published
Updated
Nov 13, 2026, 9:33 AM
Reserved
Nov 12, 2026, 8:45 PM

View source JSON

No data.

No data.

No data.

No data.