https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 13 Nov 2026 13:49:57 +0000 https://db.gcve.eu/vuln/cve-2026-128044 <p><strong>Affected:</strong> OpenMage magento-lts</p> <p>OpenMage magento-lts before 20.18.2 and 21.x before 21.0.0-beta3 validates OAuth 1.0a oauth_callback URLs with a string-prefix check and falls back to accepting any well-formed URL. Attackers holding a leaked consumer key and secret can supply host-suffix, userinfo, or arbitrary callback URLs to capture an approving administrator&#39;s or customer&#39;s request token and verifier, then obtain an access token with the victim&#39;s API privileges.</p> <p><strong>Affected:</strong> OpenMage magento-lts</p> <p>OpenMage magento-lts before 20.18.2 and 21.x before 21.0.0-beta3 validates OAuth 1.0a oauth_callback URLs with a string-prefix check and falls back to accepting any well-formed URL. Attackers holding a leaked consumer key and secret can supply host-suffix, userinfo, or arbitrary callback URLs to capture an approving administrator&#39;s or customer&#39;s request token and verifier, then obtain an access token with the victim&#39;s API privileges.</p> https://db.gcve.eu/vuln/cve-2026-128044