# CVE-2026-42207: OpenMage Magento LTS open redirect in stockAction controller

Source: https://junglewise.ai/threats/cve-2026-42207-openmage-magento-lts-open-redirect-in-stockaction-controller  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-15. Updated: 2026-05-16  
License: CC BY 4.0 with a link back

CVE-2026-42207 · Severity: medium · CVSS 6.1 · Published 2026-05-15

OpenMage Magento LTS is an e-commerce platform used to manage online stores. A vulnerability in the product stock notification system allows attackers to redirect logged-in customers to malicious external websites. This can be used to facilitate phishing attacks, steal login credentials, or distribute malware by leveraging the trust customers have in the store's legitimate domain.

Technologies: [OpenMage](https://junglewise.ai/threats/technologies/openmage), [openmage/magento-lts (Packagist)](https://junglewise.ai/threats/technologies/openmage-magento-lts). Vendors: [OpenMage](https://junglewise.ai/threats/vendors/openmage), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-42207 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42207 being exploited in the wild.

**How severe is CVE-2026-42207?** Medium severity, with a CVSS score of 6.1, published 15 May 2026.

**Which products and versions are affected?** OpenMage < 20.18.0; openmage/magento-lts (Packagist) <= 20.17.0, ECOSYSTEM:introduced=0,fixed=20.18.0.

**Is there a fix for CVE-2026-42207?** Yes. openmage/magento-lts (Packagist): upgrade to 20.18.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42207 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-42207?** Check whether you run OpenMage Magento LTS, OpenMage or openmage/magento-lts (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- openmage/magento-lts (Packagist): upgrade to 20.18.0 or later

  ```sh
  composer require openmage/magento-lts:^20.18.0
  ```


## Technical details

An open redirect vulnerability exists in Mage_ProductAlert_AddController::stockAction() due to insufficient validation of the 'uenc' parameter. When a request is made with a non-existent 'product_id', the controller fails to call _isUrlInternal() before passing the 'uenc' value to _redirectUrl(). An attacker can craft a malicious URL that, when clicked by a logged-in customer, triggers a 302 redirect to an arbitrary destination. This vulnerability is particularly effective for phishing or stealing OAuth tokens if social login is implemented. The issue is patched in version 20.18.0.

## Affected products

- OpenMage magento-lts <= 20.17.0

## Identifiers

- CVE-2026-42207
- GHSA-qpgq-5g92-j5q8

## Timeline

- 2026-05-04: disclosed
- 2026-05-05: advisory: GitHub Advisory published
- 2026-05-15: other: NVD publication

## References

- [https://api.github.com/users/0x0OZ](https://api.github.com/users/0x0OZ)
- [https://github.com/0x0OZ](https://github.com/0x0OZ)
- [https://api.github.com/users/0x0OZ/gists%7B/gist_id%7D](https://api.github.com/users/0x0OZ/gists%7B/gist_id%7D)
- [https://api.github.com/users/0x0OZ/repos](https://api.github.com/users/0x0OZ/repos)
- [https://avatars.githubusercontent.com/u/52073989?v=4](https://avatars.githubusercontent.com/u/52073989?v=4)
- [https://api.github.com/users/0x0OZ/events%7B/privacy%7D](https://api.github.com/users/0x0OZ/events%7B/privacy%7D)

## Related threats

- [OpenMage Magento LTS reflected XSS in Dataflow Profiles](https://junglewise.ai/threats/cve-2026-42458-openmage-magento-lts-reflected-xss-in-dataflow-profiles)
- [OpenMage Magento LTS predictable API session ID generation](https://junglewise.ai/threats/cve-2026-42155-openmage-magento-lts-predictable-api-session-id-generation)
- [OpenMage LTS: Customer File Upload Extension Blocklist Bypass → Remote Code Execution](https://junglewise.ai/threats/cve-2026-40488-openmage-lts-customer-file-upload-extension-blocklist-bypass)
- [OpenMage LTS: Cross-user wishlist import leads to private option & file disclosure](https://junglewise.ai/threats/cve-2026-40098-openmage-lts-cross-user-wishlist-import-leads-to-private-option)
- [OpenMage LTS has a Path Traversal Filter Bypass in Dataflow Module](https://junglewise.ai/threats/cve-2026-25525-openmage-lts-has-a-path-traversal-filter-bypass-in-dataflow)