Medium severity5.3NVD Advisory· Published Feb 4, 2026· Updated Jun 17, 2026
CVE-2026-25523
CVE-2026-25523
Description
Magento-lts is a long-term support alternative to Magento Community Edition (CE). Prior to version 20.16.1, the admin url can be discovered without prior knowledge of it's location by exploiting the X-Original-Url header on some configurations. This issue has been patched in version 20.16.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
openmage/magento-ltsPackagist | < 20.16.1 | 20.16.1 |
Affected products
3Patches
Vulnerability mechanics
References
4- github.com/OpenMage/magento-lts/security/advisories/GHSA-jg68-vhv3-9r8fnvdVendor AdvisoryWEB
- github.com/advisories/GHSA-jg68-vhv3-9r8fghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-25523ghsaADVISORY
- hackerone.com/bugsnvdPermissions RequiredWEB
News mentions
0No linked articles in our index yet.