CVE-2026-128030

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an insufficient session expiration vulnerability because MageApiModelSession::renewBySessId never checks apiuser.isactive and REST OAuth authorization never checks whether the admin user is active. Attackers holding...

CVE-2026-128030

The OpenMage magento-lts platform is vulnerable to insufficient session expiration in versions before 20.18.2 and 21.0.0-beta1 (before 21.0.0-beta3 ). The root cause is that the Mage_Api_Model_Session::_renewBySessId() method fails to verify the api_user.is_active status, and REST OAuth authoriza...

EUVD-2026-125072

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an insufficient session expiration vulnerability because MageApiModelSession::renewBySessId never checks apiuser.isactive and REST OAuth authorization never checks whether the admin user is active. Attackers holding...