# CVE-2026-128045: OpenMage Magento-LTS before 20.18.2 Authorization Bypass via Forgeable RSS Order Key

Status: published. Published: 2026-11-13. Updated: 2026-11-13.

OpenMage Magento-LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an authorization bypass in the /rss/order/status feed because its URL key is unsigned Base64-encoded JSON of the order, increment, and customer ids. Unauthenticated attackers can forge keys from enumerated sequential ids to read other customers' names, items, prices, totals, and status comments when order-status RSS is enabled.

## Remediation

- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: VulnCheck) — https://github.com/OpenMage/magento-lts/commit/fde2d109292944d705c4035d87df055b1e945ea3

## Affected products and versions

- OpenMage / magento-lts: ≥ 0; < 20.18.2 (affected, semver); 20.18.2 (unaffected, semver). Source: CNA: VulnCheck
- OpenMage / magento-lts: ≥ 21.0.0-beta1; < 21.0.0-beta3 (affected, semver); 21.0.0-beta3 (unaffected, semver). Source: CNA: VulnCheck

## Severity and prioritization

- CVSS 4.0: 6.9 (medium); CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N; source: CNA: VulnCheck

- CVSS 3.1: 5.3 (medium); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N; source: CNA: VulnCheck

- CVSS 4.0: 6.9 (medium); CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X; source: NVD: disclosure@vulncheck.com

- CVSS 3.1: 5.3 (medium); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N; source: NVD: disclosure@vulncheck.com

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-639

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/OpenMage/magento-lts/security/advisories/GHSA-3hh8-xg45-mwrr (CNA: VulnCheck; vendor-advisory)

- https://github.com/OpenMage/magento-lts/commit/fde2d109292944d705c4035d87df055b1e945ea3 (CNA: VulnCheck; patch)

- https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-authorization-bypass-via-forgeable-rss-order-key (CNA: VulnCheck; third-party-advisory)

- https://github.com/OpenMage/magento-lts/commit/fde2d109292944d705c4035d87df055b1e945ea3 (disclosure@vulncheck.com)

- https://github.com/OpenMage/magento-lts/security/advisories/GHSA-3hh8-xg45-mwrr (disclosure@vulncheck.com)

- https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-authorization-bypass-via-forgeable-rss-order-key (disclosure@vulncheck.com)

## Provenance

- CNA: VulnCheck: https://www.cve.org/CVERecord?id=CVE-2026-128045; retrieved 2026-11-13; source updated 2026-11-13

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-128045; retrieved 2026-11-13; source updated 2026-11-13

Revision: a781364ad5c73bdd3406879e21cc70d98143f33d2eb367565e1b3f2c58a6531c

Canonical: https://y2.dev/cve/CVE-2026-128045

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.