CVE-2026-25523 Magento's X-Original-Url header can expose admin url
Attackers can discover the hidden admin URL via the X-Original-Url header on specific configurations, exposing the backend entry point.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-25523?
CVE-2026-25523 is a medium-severity vulnerability in OpenMage magento-lts, published on 4 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Magento-lts is a long-term support alternative to Magento Community Edition (CE). Prior to version 20.16.1, the admin url can be discovered without prior knowledge of it's location by exploiting the X-Original-Url header on some configurations. This issue has been patched in version 20.16.1.
Weakness: CWE-200
Which versions are affected by CVE-2026-25523?
2 open source packages ship an affected version, including openmage/magento-lts. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
openmage/magento-lts Packagist | All versions | 20.16.1 |
openmage/magento-lts Packagist | All versions | 20.16.1 |
Products include Openmage Magento.
How do I fix CVE-2026-25523?
Upgrade openmage/magento-lts to 20.16.1 or later.
Is CVE-2026-25523 being exploited?
There is no known exploitation of CVE-2026-25523 in the wild and no public exploit code.
Other vulnerabilities in OpenMage magento-lts
- CVE-2021-21426 Fixes a bug in Zend Framework's Stream HTTP Wrapper
- CVE-2021-21427 Backport for CVE-2021-21024 Blind SQLi from Magento 2
- CVE-2021-41144 OpenMage LTS authenticated remote code execution through layout update
- CVE-2026-40488 OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution
- CVE-2026-25524 OpenMage LTS's Phar Deserialization leads to Remote Code Execution
Sources
Also known as GHSA-jg68-vhv3-9r8f.