What’s Vulnerable › Vulnerabilities

CVE-2026-25523: Magento's X-Original-Url header can expose admin url

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-04 · updated 2026-06-17
• Weakness: CWE-200

Description

Magento-lts is a long-term support alternative to Magento Community Edition (CE). Prior to version 20.16.1, the admin url can be discovered without prior knowledge of it's location by exploiting the X-Original-Url header on some configurations. This issue has been patched in version 20.16.1.

Affected products

• OpenMage magento-lts: through 20.16.0

References

• https://github.com/OpenMage/magento-lts/security/advisories/GHSA-jg68-vhv3-9r8f
• https://hackerone.com/bugs?subject=openmage&report_id=3416312

Get alerted when CVE-2026-25523 or the next vulnerability affects your stack