CVE-2026-25523

Published: Feb 4, 2026Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

Magento-lts is a long-term support alternative to Magento Community Edition (CE). Prior to version 20.16.1, the admin url can be discovered without prior knowledge of it's location by exploiting the X-Original-Url header on some configurations. This issue has been patched in version 20.16.1.

Affected (1)

Products: Openmage: Magento

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Openmage Magento	Up to 20.16.0

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (2)

https://github.com/OpenMage/magento-lts/security/advisories/GHSA-jg68-vhv3-9r8f

Source: security-advisories@github.com

Vendor Advisory

https://hackerone.com/bugs?subject=openmage&report_id=3416312

Source: security-advisories@github.com

Permissions Required

Timeline

No history available yet.