Executive brief
OpenMage Magento LTS, an e-commerce platform, contains a vulnerability in how it generates session identifiers for its administrative APIs. Because these identifiers are created using predictable information like the current time, an attacker can guess active session IDs. If successful, an attacker could take over an administrator's session to steal customer data, modify orders, or change product pricing.
Technical details
The XML-RPC, SOAP, and REST API session IDs in OpenMage LTS are generated in `Mage_Api_Model_Session::start()` using `md5(time() . uniqid('', true))`. This construction relies on predictable inputs: the Unix timestamp, a microsecond-based prefix, and a deterministic LCG float. An attacker can narrow the entropy window by observing network timing and server state. By leveraging the lack of rate limiting on API endpoints, an attacker can perform a high-speed online brute-force attack to predict and hijack active API sessions. This grants the attacker full access to API resources, including customer PII and order management. The issue is patched in version 20.18.0 by implementing `random_bytes()` for CSPRNG-based token generation.
Affected products
- OpenMage magento-lts (OpenMage) <= 20.17.0
Timeline
- 2026-05-04: advisory: GHSA-2cwr-gcf9-pvxr published
- 2026-05-05: disclosed: Public disclosure of CVE-2026-42155
- 2026-05-15: other: Advisory updated