CVE-2026-128045

OpenMage Magento-LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an authorization bypass in the /rss/order/status feed because its URL key is unsigned Base64-encoded JSON of the order, increment, and customer ids. Unauthenticated attackers can forge keys from enumerated sequentia...

CVE-2026-128045

OpenMage Magento-LTS versions before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 are vulnerable to an authorization bypass in the /rss/order/status feed. The root cause is that the feed's URL key consists of unsigned Base64-encoded JSON containing order, increment, and customer IDs. This allows ...

EUVD-2026-125063

OpenMage Magento-LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an authorization bypass in the /rss/order/status feed because its URL key is unsigned Base64-encoded JSON of the order, increment, and customer ids. Unauthenticated attackers can forge keys from enumerated sequentia...