Skip to content

CVE record · 1 source

CVE-2026-128030

CVSS 5.9

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an insufficient session expiration vulnerability because…

Vendor: OpenMage
Product: magento-lts
CVSS v3.1: 5.9 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-613
Exposure class: Web platform

Coverage

1

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

23

CVE NVD 11h ago

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an insufficient session expiration vulnerability because…

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an insufficient session expiration vulnerability because Mage_Api_Model_Session::_renewBySessId() never checks api_user.is_active and REST OAuth…

CVSS 5.9 CVE-2026-128030 OpenMage