Moderate severityNVD Advisory· Published Feb 4, 2026· Updated Feb 4, 2026
Magento's X-Original-Url header can expose admin url
CVE-2026-25523
Description
Magento-lts is a long-term support alternative to Magento Community Edition (CE). Prior to version 20.16.1, the admin url can be discovered without prior knowledge of it's location by exploiting the X-Original-Url header on some configurations. This issue has been patched in version 20.16.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
openmage/magento-ltsPackagist | < 20.16.1 | 20.16.1 |
Affected products
2Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-jg68-vhv3-9r8fghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-25523ghsaADVISORY
- github.com/OpenMage/magento-lts/security/advisories/GHSA-jg68-vhv3-9r8fghsax_refsource_CONFIRMWEB
- hackerone.com/bugsghsax_refsource_MISCWEB
News mentions
0No linked articles in our index yet.