CVE Intelligence
Analysis AI-assisted

CVE-2026-42155: OpenMage Magento-lts: predictable API session IDs (CWE-330)

OpenMage Magento-lts versions prior to 20.18.0 generate XML-RPC and SOAP API session IDs with a time-based MD5 construction instead of a cryptographically secure generator, classified as CWE-330. The CNA rated the issue critical with a CVSS 4.0 base score of 9.3, and the record states it is fixed in 20.18.0. No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

OpenMage Magento-lts (Magento LTS) is a community-maintained alternative to Magento Community Edition. According to the CNA record, the session identifier used by the XML-RPC and SOAP APIs is built from an outdated time-based construction rather than a cryptographically secure random generator, which corresponds to CWE-330.

Impact

  • Session identifiers for the API may be predictable, which weakens the confidentiality and integrity of API sessions.
  • The record states that predictable internal state and the absence of API rate limiting could let an attacker guess active session identifiers online.
  • The CNA assigned a CVSS 4.0 base score of 9.3 (critical), with high confidentiality and integrity impact and low availability impact.

Affected products and versions

  • Product: OpenMage Magento-lts.
  • Affected versions: those before 20.18.0, according to the record.
  • The structured fixed-version field is empty, but the description states the issue is fixed in 20.18.0.

Exploitation status

  • CISA KEV does not list this CVE in the data consulted.
  • No confirmed exploitation in the wild appears in the sources consulted.
  • The SSVC exploitation value is recorded as poc, which indicates a proof-of-concept state and does not confirm exploitation.
  • The EPSS probability is recorded as 0.00486 with a percentile of 0.40139.

Remediation and mitigation

  • Upgrade OpenMage Magento-lts to version 20.18.0 or later, as stated in the record.
  • Review the GitHub Security Advisory GHSA-2cwr-gcf9-pvxr for vendor guidance.
  • Until the upgrade is applied, limit network exposure of the XML-RPC and SOAP API endpoints to trusted sources.
  • After upgrading, consider invalidating existing API sessions as a precaution.

Detection guidance

  • Review API access logs for unusual volumes of session or authentication requests from a single source.
  • Look for successful API sessions originating from unexpected addresses or at unusual times.
  • Monitor for bursts of failed session attempts, since the record notes that API rate limiting was absent.

Limitations of the available information

  • The record does not provide a structured fixed-version field or a detailed list of affected versions beyond the range below 20.18.0.
  • The conditions under which internal PRNG state could be exposed are not described in detail.
  • The record has a deferred source status, and the only listed reference is the vendor advisory.

Frequently asked questions

Which versions of OpenMage Magento-lts are affected?

According to the record, versions before 20.18.0 are affected. The description states the issue is fixed in 20.18.0.

Is this vulnerability known to be exploited in the wild?

CISA KEV does not list this CVE, and no confirmed exploitation appears in the sources consulted. The SSVC value poc refers to a proof-of-concept state, not confirmed exploitation.

What should administrators do first?

Upgrade to 20.18.0 or later, review the vendor advisory, and restrict network access to the XML-RPC and SOAP API endpoints until the upgrade is done.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.