CVE-2026-128032

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 accepts the free No Payment Information Required payment method on orders with a non-zero total because the zero-total check runs only when payment data is imported. An API user with cart permissions can select free via...

EUVD-2026-125070

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 accepts the free No Payment Information Required payment method on orders with a non-zero total because the zero-total check runs only when payment data is imported. An API user with cart permissions can select free via...

CVE-2026-128032 OpenMage magento-lts before 20.18.2 Payment Bypass via Free Payment Method

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 accepts the free No Payment Information Required payment method on orders with a non-zero total because the zero-total check runs only when payment data is imported. An API user with cart permissions can select free via...

CVE-2026-128032

OpenMage magento-lts versions before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 are vulnerable to a payment bypass via the free (No Payment Information Required) payment method. The root cause is that the zero-total check only executes during payment data import. An API user with cart permissio...