CVE-2026-25523
Magento's X-Original-Url header can expose admin url
Magento-lts is a long-term support alternative to Magento Community Edition (CE). Prior to version 20.16.1, the admin url can be discovered without prior knowledge of it's location by exploiting the X-Original-Url header on some configurations. This issue has been patched in version 20.16.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Magento's X-Original-Url header can expose admin url
Magento-lts is a long-term support alternative to Magento Community Edition (CE). Prior to version 20.16.1, the admin url can be discovered without prior knowledge of it's location by exploiting the X-Original-Url header on some configurations. This issue has been patched in version 20.16.1.
- Record
CVE-2026-25523- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2026-5330
Magento-lts is a long-term support alternative to Magento Community Edition (CE). Prior to version 20.16.1, the admin url can be discovered without prior knowledge of it's location by exploiting the X-Original-Url header on some configurations. This issue has been patched in version 20.16.1.
- Record
EUVD-2026-5330- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-jg68-vhv3-9r8f
Magento's X-Original-Url header can expose admin url
Impact
The admin url can be discovered without prior knowledge of it's location by exploiting the X-Original-Url header on some configurations.
Patches
The bug comes from the Zend library and is patche by unsetting the header in the bootstrap process.
Workarounds
Unset the X-Original-Url header in the web server configuration.
References
The activation of these headers is coming from the Zend_Controller module. It appears this has been known to some degree since 2016 - https://peterocallaghan.co.uk/2016/12/magento-poisoning-cache/ (dead link now..)
Credit
Anees Hyder ( @anees0xdev ) via HackerOne https://hackerone.com/anees0x_dev/hacktivity
- Record
GHSA-jg68-vhv3-9r8f- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
NVD
Magento-lts is a long-term support alternative to Magento Community Edition (CE). Prior to version 20.16.1, the admin url can be discovered without prior knowledge of it's location by exploiting the X-Original-Url header on some configurations. This issue has been patched in version 20.16.1.
- Record
CVE-2026-25523- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
Magento's X-Original-Url header can expose admin url
Magento-lts is a long-term support alternative to Magento Community Edition (CE). Prior to version 20.16.1, the admin url can be discovered without prior knowledge of it's location by exploiting the X-Original-Url header on some configurations. This issue has been patched in version 20.16.1.
- Record
CVE-2026-25523- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-jg68-vhv3-9r8f
Magento's X-Original-Url header can expose admin url
Impact
The admin url can be discovered without prior knowledge of it's location by exploiting the X-Original-Url header on some configurations.
Patches
The bug comes from the Zend library and is patche by unsetting the header in the bootstrap process.
Workarounds
Unset the X-Original-Url header in the web server configuration.
References
The activation of these headers is coming from the Zend_Controller module. It appears this has been known to some degree since 2016 - https://peterocallaghan.co.uk/2016/12/magento-poisoning-cache/ (dead link now..)
Credit
Anees Hyder ( @anees0xdev ) via HackerOne https://hackerone.com/anees0x_dev/hacktivity
- Record
GHSA-jg68-vhv3-9r8f- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openmage/magento-ltsPackagist |
before 20.16.1 | 20.16.1 |
openmage/magento-ltsPackagist |
before 20.16.1, plus listed versions 1.9.1.11.9.2.01.9.2.11.9.2.21.9.2.3 Show 45 moreShow less1.9.2.41.9.3.01.9.3.1v19.4.0v19.4.1v19.4.10v19.4.11v19.4.12v19.4.13v19.4.14v19.4.15v19.4.16v19.4.17v19.4.18v19.4.19v19.4.2v19.4.20v19.4.21v19.4.22v19.4.23v19.4.3v19.4.4v19.4.5v19.4.6v19.4.7v19.4.8v19.4.9v19.5.0v19.5.0-rc1v19.5.0-rc2v19.5.0-rc3v19.5.0-rc4v19.5.0-rc5v19.5.1v19.5.2v19.5.3v20.0.0v20.0.1v20.0.10v20.0.11v20.0.12v20.0.13v20.0.14v20.0.15v20.0.16 |
20.16.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-25523 is a medium vulnerability (CVSS 5.3) in Openmage Magento, published February 2, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 25th percentile. Fixed in openmage/magento-lts 20.16.1.
References
github.com/OpenMage/magento-lts/security/advisories/GHSA-jg68-vhv3-9r8f
hackerone.com/bugs?subject=openmage&report_id=3416312
nvd.nist.gov/vuln/detail/CVE-2026-25523
Left out here: 40 versions. The JSON record has them.