Magento LTS: Weak API Session ID — Predictable MD5 of Time-Derived Inputs_CVE-2026-42155

{
    "lastseen": "",
    "description": "Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to 20.18.0, the XML-RPC / SOAP API session ID is generated using an outdated, time-based construction rather than a Cryptographically Secure Pseudo-Random Number Generator (CSPRNG). All inputs to the MD5 hash are time-derived and non-secure. Because the resulting digest relies entirely on the timestamp and the PHP internal LCG state, the effective entropy is severely constrained. This violates the OWASP ASVS v4 requirement of \u2265 64 bits of entropy (V3.2.2) and NIST SP 800-63B standards. By narrowing the LCG window (via server state leaks or general predictability) and leveraging the lack of API rate-limiting, an attacker can generate a localized pool of candidate MD5 hashes and execute a high-speed online brute-force attack to hijack active API sessions. This vulnerability is fixed in 20.18.0.",
    "published": "2026-05-15T17:05:02.436Z",
    "modified": "2026-05-15T17:05:02.436Z",
    "type": "cve",
    "title": "Magento LTS: Weak API Session ID \u2014 Predictable MD5 of Time-Derived Inputs",
    "source": "GitHub_M",
    "references": "https://github.com/OpenMage/magento-lts/security/advisories/GHSA-2cwr-gcf9-pvxr",
    "id": "CVE-2026-42155",
    "bulletinFamily": "",
    "cwe": [
        "CWE-330",
        "CWE-331",
        "CWE-338"
    ],
    "cvelist": null,
    "sourceData": "OpenMage magento-lts < 20.18.0",
    "sourceHref": "",
    "cvss": {
        "score": 9.3,
        "severity": "CRITICAL",
        "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "magento-lts",
    "version": "< 20.18.0",
    "vendor": "OpenMage",
    "ai_description": "Weak API Session ID due to predictable MD5 hash of time-derived inputs, allowing for brute-force attack to hijack active API sessions",
    "ai_severity": "Critical",
    "ai_vendor": "OpenMage",
    "ai_product": "Magento LTS",
    "ai_version": "< 20.18.0",
    "ai_score": 9.3
}