The vulnerability arises from the Magento LTS XML‑RPC / SOAP API session ID generation. Session identifiers were produced by hashing only timestamp‑derived data with MD5, without any cryptographic salt or secure source of randomness. Consequently the resulting digests have far less than the required 64 bits of entropy and can be predicted and brute‑forced by an attacker. An attacker who learns the time or can observe server state can generate a small set of candidate hashes, perform high‑speed online brute‑force, and hijack active API sessions. The flaw violates OWASP ASVS and NIST SP 800‑63B session‑id entropy requirements.

The affected product is OpenMage Magento LTS. All versions older than 20.18.0 are vulnerable. The vulnerability was fixed in release 20.18.0.

The CVSS score is 9.3, reflecting a high‑severity exploit that can be carried out remotely against any internet‑exposed instance that uses the XML‑RPC/SOAP API. EPSS data is unavailable, and the vulnerability is not listed in CISA KEV; however, the lack of rate limiting combined with the low‑entropy session IDs makes a brute‑force attack highly feasible. An attacker can enumerate session identifiers in real time, hijack sessions, and gain unauthorized access to the API. The vulnerability does not require authentication to the API itself, only the ability to send requests to the exposed endpoints. The vulnerability can be exploited from outside the organisation with knowledge of the target server’s clock or by leveraging predictable LCG state leakage.