Magento's X-Original-Url header can expose admin url

TRUNG BÌNH 5.3CVE-2026-25523 · GHSA-jg68-vhv3-9r8f · Công bố 04/02/2026 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2026-25523 là lỗ hổng mức TRUNG BÌNH (CVSS 5.3) ảnh hưởng openmage/magento-lts, magento (openmage).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.32%, cao hơn 25.3% các lỗ hổng khác.
Cách xử lý: cập nhật lên 20.16.1 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
openmage/magento-lts Packagist	`< 20.16.1`	`20.16.1`
magento openmage	`≤ 20.16.0`	Chưa có bản vá

Mô tả

Impact

The admin url can be discovered without prior knowledge of it's location by exploiting the X-Original-Url header on some configurations.

Patches

The bug comes from the Zend library and is patche by unsetting the header in the bootstrap process.

Workarounds

Unset the X-Original-Url header in the web server configuration.

References

The activation of these headers is coming from the Zend_Controller module. It appears this has been known to some degree since 2016 - https://peterocallaghan.co.uk/2016/12/magento-poisoning-cache/ (dead link now..)

Credit

Anees Hyder ( @anees0xdev ) via HackerOne https://hackerone.com/anees0x_dev/hacktivity

Mô tả của NVD

Magento-lts is a long-term support alternative to Magento Community Edition (CE). Prior to version 20.16.1, the admin url can be discovered without prior knowledge of it's location by exploiting the X-Original-Url header on some configurations. This issue has been patched in version 20.16.1.