CVE-2026-25523
Medium · 5.3CVSS
5.3
EPSS
0.4%
Published
Feb 4, 2026
CISA due date
—
The record
Magento-lts is a long-term support alternative to Magento Community Edition (CE). Prior to version 20.16.1, the admin url can be discovered without prior knowledge of it's location by exploiting the X-Original-Url header on some configurations. This issue has been patched in version 20.16.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | openmage/magento-lts | 0 | 20.16.1 |
Related vulnerabilities
- GHSA-jg68-vhv3-9r8f Magento's X-Original-Url header can expose admin url Same vulnerability
- CVE-2025-64174 Magento-lts is a long-term support alternative to Magento Community Edition (CE). Also affects openmage/magento-lts
- GHSA-qv78-c8hc-438r OpenMage vulnerable to XSS in Admin Notifications Also affects openmage/magento-lts
- CVE-2026-114657 Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows… CWE-200
- CVE-2026-114574 A security vulnerability has been detected in massCodeIO massCode 5.10. CWE-200
- CVE-2026-111756 follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows… CWE-200
- CVE-2026-111755 follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows… CWE-200
- CVE-2026-112091 A flaw has been found in Dav-ee dairy-management-system… CWE-200