CVE-2026-42207 Details
Description
Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to 20.18.0, Mage_ProductAlert_AddController::stockAction() reads the uenc query parameter and passes it directly to $this->_redirectUrl($backUrl) without calling $this->_isUrlInternal(). When the supplied product_id does not match any catalog product, the server issues an unvalidated HTTP 302 redirect to whatever URL was provided as uenc. This vulnerability is fixed in 20.18.0.
An open redirect vulnerability has been identified in OpenMage Magento Long Term Support (LTS) versions through 20.17.0. The issue arises in the `Mage_ProductAlert_AddController::stockAction()` method, where the `uenc` query parameter is accepted without proper validation. When a non-existent `product_id` is provided, the application redirects to the URL specified in `uenc`, creating an unvalidated HTTP 302 redirect. This vulnerability could be exploited by sending a crafted link to a logged-in customer, taking advantage of the lack of URL validation to redirect them to an external site.
Users are advised to update to OpenMage Magento LTS version 20.18.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 15, 2026CISA-ADP
Assessed May 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/OpenMage/magento-lts/security/advisories/GHSA-qpgq-5g92-j5q8 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/OpenMage/magento-lts/security/advisories/GHSA-qpgq-5g92-j5q8 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenMage Magento Long Term Support | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 15, 2026 | CVE Modified | CISA-ADP |
| May 15, 2026 | New CVE Received | [email protected] |