PT-2026-6440 · Packagist · Openmage Magento Lts

Published 2026-02-02 · Updated 2026-02-02

OSV

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Impact

The admin url can be discovered without prior knowledge of it's location by exploiting the X-Original-Url header on some configurations.

Patches

The bug comes from the Zend library and is patche by unsetting the header in the bootstrap process.

Workarounds

Unset the X-Original-Url header in the web server configuration.

References

The activation of these headers is coming from the Zend Controller module. It appears this has been known to some degree since 2016 - https://peterocallaghan.co.uk/2016/12/magento-poisoning-cache/ (dead link now..)

Credit

Anees Hyder ( @anees0xdev ) via HackerOne https://hackerone.com/anees0x dev/hacktivity

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

GHSA-JG68-VHV3-9R8F

Affected Products

Openmage Magento Lts

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-25523 · Security Note
• https://osv.dev/vulnerability/GHSA-jg68-vhv3-9r8f · Vendor Advisory
• https://github.com/OpenMage/magento-lts · Note
• https://github.com/OpenMage/magento-lts/security/advisories/GHSA-jg68-vhv3-9r8f · Note
• https://hackerone.com/bugs?subject=openmage&report_id=3416312 · Note