Description
OpenMage magento-lts before 20.18.2 and 21.0.0-beta pre-releases before 21.0.0-beta3 generate customer email-confirmation keys with md5(uniqid()) and customer and administrator password-reset tokens with the non-cryptographic uniqHash(). Unauthenticated attackers can brute-force the roughly 20-bit confirmation key via the unrate-limited confirmAction endpoint to log in as pending customers, or predict administrator reset tokens after recovering generator state.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenMage | magento-lts | < 20.18.2, 21.0.0-beta1 – < 21.0.0-beta3 | 20.18.2 |
References
- GitHub Security Advisory (GHSA-7j66-6mw7-rgfx) vendor-advisory
- Patch Commit patch
- Patch Commit patch
- VulnCheck Advisory: OpenMage magento-lts before 20.18.2 Account Takeover via Predictable Confirmation Key third-party-advisory