OpenMage fixes 34 Magento LTS flaws, including critical OAuth CSRF

OpenMage has released Magento LTS 20.19.0 and 20.18.2 to fix 34 vulnerabilities, the most severe being a critical OAuth CSRF issue rated CVSS 9.0. The OpenMage project describes the flaw as “CSRF in OAuth authorization grants persistent admin or customer REST API tokens,” where the OAuth approval step could be manipulated to grant lasting tokens without the user’s knowledge.

The advisory notes that CSRF checks have been added to the authorize controllers and approval buttons, and a CVE ID has been requested but has not yet been assigned.

The release also patches eight other high‑severity flaws, including several authenticated remote code execution paths, a guest‑upload remote code execution through blocklist gaps (CVSS 8.1), predictable tokens enabling account takeover (CVSS 8.1), and stored XSS in RSS feeds (CVSS 8.0), among others (OAuth callback allowlist bypass CVSS 7.7; four authenticated code execution or layout bypass bugs CVSS 7.2).

Affected versions are not fully enumerated in the notes; stores running releases before 20.18.2 or 20.19.0 should assume exposure, and the 21.x pre‑release line is also affected. The guidance is to upgrade to OpenMage LTS 20.18.2 (a security‑only patch atop 20.18.0) or, preferably, to 20.19.0, which also addresses three low‑severity bugs that 20.18.2 does not. For those on the 21.x line, OpenMage v21.0.0-beta3 is available.

Organisations should review and revoke unexpected OAuth consumers and REST API tokens, with merchants using Magento 1 particularly urged to apply the fixes promptly to mitigate token‑based access risks. No exploitation in the wild is reported, and no public PoC has been confirmed.