Dashboard / CVE-2026-128044

CVE-2026-128044

HIGH
MEDIUM Priority: 0.02 BB Relevance: 47/100
Published: 2026-11-13 Modified: 2026-11-13 First seen: 2026-11-13 Status: active

Attack Surface

Network Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: High
PR: Low
UI: Passive
S: X
AT: Present
VC: High
VI: High
VA: None

Description

OpenMage magento-lts before 20.18.2 and 21.x before 21.0.0-beta3 validates OAuth 1.0a oauth_callback URLs with a string-prefix check and falls back to accepting any well-formed URL. Attackers holding a leaked consumer key and secret can supply host-suffix, userinfo, or arbitrary callback URLs to capture an approving administrator's or customer's request token and verifier, then obtain an access token with the victim's API privileges.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
OpenMage magento-lts 0 < 20.18.2
OpenMage magento-lts 21.0.0-beta1 < 21.0.0-beta3

References & Advisories (3)

Bug Bounty Relevance

47 / 100
✓ Network accessible

CVSS Score

8.7 / 10.0 v4.0
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.19%
Raw Score 0.001900
Percentile 8.8%
Date 2026-11-13

Intelligence Sources

mitre ref →
nvd ref →

External Links