TI-2026-30484 Aliases CVE-2026-42155 GHSA-2cwr-gcf9-pvxr

Magento LTS: Weak API Session ID — Predictable MD5 of Time-Derived Inputs

HIGH 81CWE-330Published 2026-05-15 · Updated 2026-05-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: High · High · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to 20.18.0, the XML-RPC / SOAP API session ID is generated using an outdated, time-based construction rather than a Cryptographically Secure Pseudo-Random Number Generator (CSPRNG). All inputs to the MD5 hash are time-derived and non-secure. Because the resulting digest relies entirely on the timestamp and the PHP internal LCG state, the effective entropy is severely constrained. This violates the OWASP ASVS v4 requirement of ≥ 64 bits of entropy (V3.2.2) and NIST SP 800-63B standards. By narrowing the LCG window (via server state leaks or general predictability) and leveraging the lack of API rate-limiting, an attacker can generate a localized pool of candidate MD5 hashes and execute a high-speed online brute-force attack to hijack active API sessions. This vulnerability is fixed in 20.18.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00366 30th percentileScored 2026-11-07

Fix Fixed magento-lts (OpenMage): 20.18.0openmage/magento-lts (Packagist): 20.18.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OpenMage	magento-lts	before 20.18.0	20.18.0	Patch available	CNA
—	openmage/magento-lts (Packagist)	before 20.18.0	20.18.0	Patch available	GHSA-2cwr-gcf9-pvxr

magento-lts VendorOpenMage Affected before 20.18.0 Fixed in 20.18.0 Patch available CNA
openmage/magento-lts (Packagist) Vendor— Affected before 20.18.0 Fixed in 20.18.0 Patch available GHSA-2cwr-gcf9-pvxr

Remediation

Fix · CNA magento-lts (OpenMage) Fixed in 20.18.0
Fix · GHSA-2cwr-gcf9-pvxr openmage/magento-lts (Packagist) Fixed in 20.18.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-42155
2026-10-03 Alias added: GHSA-2cwr-gcf9-pvxr

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-42155

Other 2

TI-2026-20633 OpenMage LTS's Phar Deserialization leads to Remote Code Execution CVSS 3.1HIGH 8.1
TI-2026-29239 OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution CVSS 4.0HIGH 8.7
TI-2023-22272 Magento LTS's guest order "protect code" can be brute-forced too easily CVSS 3.1HIGH 7.5
TI-2026-30528 Magento LTS: Open Redirect via Unvalidated `uenc` Parameter in `stockAction()` - magento-lts CVSS 3.1MEDIUM 6.1
TI-2026-30747 Magento LTS: Reflected XSS - Import -> Data Flow (profiles) CVSS 4.0MEDIUM 5.3
TI-2026-28925 Missing authorization in OpenMage magento-lts CVSS 4.0MEDIUM 5.3

See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences