OpenMage shipped Magento LTS 20.19.0 and 20.18.2 on October 26, fixing 34 vulnerabilities, including one critical flaw rated CVSS 9.0 and eight high-severity bugs. Several of the high-severity bugs are authenticated remote code execution paths.
The account comes from a single outlet. It is separate from the Sansec report on a Magento store infection campaign, though Magento stores are under attack on several fronts.
Critical OAuth Authorization Flaw Lacked CSRF Protection
The critical flaw is cross-site request forgery in OAuth authorization. The approval step had no CSRF protection, so an attacker could trick a logged-in admin or customer into approving an OAuth application. The result would be a persistent admin or customer REST API token.
Advisory GHSA-grrq-9gq2-vm55 and the Pending CVE
The flaw is tracked as advisory GHSA-grrq-9gq2-vm55. A CVE has been requested but not yet assigned. The fix adds CSRF checks to the authorize controllers and to the approval buttons.
Eight High-Severity Bugs Include Authenticated Code Execution
Beyond the critical flaw, OpenMage fixed eight high-severity bugs, several of which are authenticated paths to remote code execution. The report does not list the individual identifiers for the high-severity bugs.
OpenMage Release Notes Omit the Affected Version Range
The release notes list the fixed versions, 20.19.0 and 20.18.2, but not the full range of affected versions. Users are directed to upgrade to one of the two releases.
OpenMage Keeps Magento 1 Stores Running After Adobe’s Support Ended
OpenMage maintains Magento 1 stores that remain in use after Adobe ended support for that platform. The project claims 100,000 active installs, which is its own estimate and was not independently verified.
Lasting API Access on Payment-Handling Stores
An admin token stolen through the OAuth flaw would give lasting API access to a store that handles payments. Because the token is persistent, access would continue after the user’s browser session ended unless the token were revoked.
The report states that there is no exploitation in the wild and no public proof-of-concept confirmed.
Context: Magento Stores Under Wider Attack
Sansec reported separately this week that an unknown actor has infected 953 online stores, mostly Magento, and the OpenMage fixes are unrelated to that campaign. The two stories concern different problems: one is a batch of vulnerabilities fixed in a community-maintained Magento fork, and the other is an infection campaign on stores running Magento and Adobe Commerce.
The pending CVE assignment means vulnerability scanners and tracking tools may not yet list the critical OAuth flaw under a CVE identifier, and the GHSA advisory is the identifier currently available.
What the OpenMage Release Notes Leave Out
The October 26 release notes name the fixed versions, 20.19.0 and 20.18.2, but not the full range of affected versions. That leaves some uncertainty for stores on older builds, and the report does not resolve it. OpenMage also has not published a CVE for the critical flaw, only the GHSA advisory.
The scale of the release is notable: 34 vulnerabilities fixed at once, one critical at CVSS 9.0 and eight rated high. The report says several of the high-severity bugs are authenticated remote code execution paths, meaning an attacker would need an account, but it does not name them.
The critical OAuth flaw works through a common action. An attacker tricks a logged-in admin or customer into approving an OAuth application, and the approval produces a token the attacker can use against the REST API. For an admin, that is a persistent admin API token. The repair adds CSRF checks to the authorize controllers and the approval buttons.
OpenMage’s role matters to the stores affected. The project keeps Magento 1 stores alive after Adobe ended support, so merchants running those stores rely on OpenMage for security fixes. The project’s own estimate of 100,000 active installs sets the possible scale of the exposure, though it has not been independently confirmed.
