Executive brief
Magento's X-Original-Url header can expose admin url
Affected products
- Packagist openmage/magento-lts
Junglewise Threat Intelligence
CVE-2026-25523: Magento's X-Original-Url header can expose admin url
CVE-2026-25523 · Severity: low · CVSS 3.1 · Published 2026-02-02
Technologies: openmage/magento-lts (Packagist). Vendors: Packagist.
Related threats
- OpenMage Magento LTS reflected XSS in Dataflow Profiles
- OpenMage Magento LTS open redirect in stockAction controller
- OpenMage Magento LTS predictable API session ID generation
- OpenMage LTS: Customer File Upload Extension Blocklist Bypass → Remote Code Execution
- OpenMage LTS: Cross-user wishlist import leads to private option & file disclosure