OpenMage vulnerabilities
We track 11 vulnerabilities in OpenMage products across 2 products. 11 are rated high or critical, and none are known to be exploited. The most recent was published on November 13, 2026.
Latest OpenMage vulnerabilities
- 9.0 Critical severity
magento-lts: Cross-Site Request Forgery
OpenMage Magento LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a cross-site request forgery vulnerability in the admin and storefront OAuth confirm and confirmSimple actions, which accept GET requests without form-key validation. Attackers h
- 8.1 High severity
magento-lts: Use of Insufficiently Random Values
OpenMage magento-lts before 20.18.2 and 21.0.0-beta pre-releases before 21.0.0-beta3 generate customer email-confirmation keys with md5(uniqid()) and customer and administrator password-reset tokens with the non-cryptographic uniqHash(). Unauthenticated attack
- 8.1 High severity
magento-lts: Incomplete List of Disallowed Inputs
OpenMage magento-lts 20.17.0 before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an unrestricted file upload vulnerability because the general/file/protected_extensions blocklist omits phar, php8, and phps. Unauthenticated attackers can upload a .phar
- 7.7 High severity
magento-lts: Origin Validation Error
OpenMage magento-lts before 20.18.2 and 21.x before 21.0.0-beta3 validates OAuth 1.0a oauth_callback URLs with a string-prefix check and falls back to accepting any well-formed URL. Attackers holding a leaked consumer key and secret can supply host-suffix, use
- 8.0 High severity
magento-lts: Improper Neutralization of Input During Web Page Generation
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 serves RSS feeds with a text/html content type and does not escape feed entry data, leading to stored cross-site scripting. An unauthenticated guest can submit a product review with scrip
- 7.5 High severity
magento-lts: Improper Neutralization of Script in Attributes of IMG Tags in a Web Page
OpenMage magento-lts before 20.2.0 contains a stored cross-site scripting vulnerability because the TinyMCE WYSIWYG editor fails to filter scripts in specially crafted HTML tags. Attackers can inject an img element with a malicious onmouseover attribute to exe
- 9.3 Critical severity
magento-lts: Use of Insufficiently Random Values
Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to 20.18.0, the XML-RPC / SOAP API session ID is generate
- 8.8 High severity
magento-lts: Unrestricted Upload of File with Dangerous Type
Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, the product custom option file upload
- 8.1 High severity
magento-lts: Deserialization of Untrusted Data
Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, PHP functions such as `getimagesize()
- 7.5 High severity
magento-lts: Use of Insufficiently Random Values
Magento LTS is the official OpenMage LTS codebase. Guest orders may be viewed without authentication using a "guest-view" cookie which contains the order's "protect_code". This code is 6 hexadecimal characters which is arguably not enough to prevent a brute-fo
- 7.5 High severity
magento-lts: Loop with Unreachable Exit Condition
OpenMage LTS is an e-commerce platform. Versions prior to 19.4.22 and 20.0.19 contain an infinite loop in malicious code filter in certain conditions. Versions 19.4.22 and 20.0.19 have a fix for this issue. There are no known workarounds.