CVE-2026-42207: OpenMage Magento LTS open redirect in stockAction controller

CVE-2026-42207 · Severity: medium · CVSS 6.1 · Published 2026-05-15

OpenMage Magento LTS is an e-commerce platform used to manage online stores. A vulnerability in the product stock notification system allows attackers to redirect logged-in customers to malicious external websites. This can be used to facilitate phishing attacks, steal login credentials, or distribute malware by leveraging the trust customers have in the store's legitimate domain.

Technologies: OpenMage, openmage/magento-lts (Packagist). Vendors: OpenMage, Packagist.

Quick answers

Is CVE-2026-42207 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42207 being exploited in the wild.
How severe is CVE-2026-42207?
Medium severity, with a CVSS score of 6.1, published 15 May 2026.
Which products and versions are affected?
OpenMage < 20.18.0; openmage/magento-lts (Packagist) <= 20.17.0, ECOSYSTEM:introduced=0,fixed=20.18.0.
Is there a fix for CVE-2026-42207?
Yes. openmage/magento-lts (Packagist): upgrade to 20.18.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42207 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-42207?
Check whether you run OpenMage Magento LTS, OpenMage or openmage/magento-lts (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • openmage/magento-lts (Packagist): upgrade to 20.18.0 or later
    composer require openmage/magento-lts:^20.18.0

Technical details

An open redirect vulnerability exists in Mage_ProductAlert_AddController::stockAction() due to insufficient validation of the 'uenc' parameter. When a request is made with a non-existent 'product_id', the controller fails to call _isUrlInternal() before passing the 'uenc' value to _redirectUrl(). An attacker can craft a malicious URL that, when clicked by a logged-in customer, triggers a 302 redirect to an arbitrary destination. This vulnerability is particularly effective for phishing or stealing OAuth tokens if social login is implemented. The issue is patched in version 20.18.0.

Affected products

  • OpenMage magento-lts <= 20.17.0

Identifiers

  • CVE-2026-42207
  • GHSA-qpgq-5g92-j5q8

Timeline

  • 2026-05-04: disclosed
  • 2026-05-05: advisory: GitHub Advisory published
  • 2026-05-15: other: NVD publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.