CVE-2026-42155

The API session identifier is created as an MD5 hash, with all input data derived from the current system time and the internal state of PHP's pseudorandom number generator (LCG). Since the effective entropy of the resulting token is very limited, an attacker can narrow down the search space by leveraging server state leaks or the general predictability of LCG. Subsequently, due to the lack of rate-limiting mechanisms in the API, the attacker performs a fast online brute-force attack on a limited pool of candidate MD5 hashes. In this way, they are able to hit an active session identifier and hijack it. The vulnerability violates OWASP ASVS v4 requirements (V3.2.2 — minimum 64 bits of entropy) and NIST SP 800-63B standards.

An attacker can hijack an active API session (XML-RPC/SOAP) of a privileged user or integration, gaining full access to operations available through this API — including reading and modifying store and customer data.

Magento LTS should be updated to version 20.18.0 or later, where the issue has been fixed by implementing a cryptographically secure random number generator (CSPRNG) for creating API session identifiers. Additionally, it is recommended to implement rate-limiting on XML-RPC/SOAP endpoints to make brute-force attacks more difficult.

Magento Long Term Support (LTS) — versions before 20.18.0 (unofficial, community-driven OpenMage project as an alternative to Magento Community Edition).