CVE-2026-25523: 
PHP vulnerability analysis and mitigation

CVE-2026-25523 is an information disclosure vulnerability in OpenMage magento-lts (a long-term support alternative to Magento Community Edition) that allows unauthenticated remote attackers to discover the hidden admin URL by exploiting the X-Original-Url HTTP header. The vulnerability affects all versions of openmage/magento-lts prior to 20.16.1 and was disclosed on February 2, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, OpenMage Advisory).

The root cause lies in the Zend_Controller module's handling of the X-Original-Url HTTP header, which is trusted and processed by the application without sanitization (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor). On certain server configurations, an attacker can send a crafted HTTP request with a manipulated X-Original-Url header to probe and enumerate the location of the Magento admin panel, which is typically obfuscated as a security measure. The fix was applied in the bootstrap process by unsetting this header before it can be consumed by the Zend library. The issue has reportedly been known in some form since at least 2016, as referenced in a now-defunct blog post about Magento cache poisoning (OpenMage Advisory, GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to discover the custom admin URL of a Magento-lts installation without any prior knowledge of its location. While the direct impact is limited to confidentiality (no integrity or availability impact), exposing the admin URL significantly lowers the barrier for follow-on attacks such as brute-force login attempts, credential stuffing, or targeted exploitation of admin-panel vulnerabilities. This reconnaissance capability could facilitate unauthorized access to the store's backend, potentially leading to data theft, order manipulation, or full site compromise (GitHub Advisory, OpenMage Advisory).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.011% (1st percentile), indicating a low near-term exploitation probability. The vulnerability was reported by security researcher Anees Hyder (@anees0xdev) via HackerOne and is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, OpenMage Advisory).

1. Reconnaissance: Identify internet-facing OpenMage magento-lts instances running versions prior to 20.16.1 using tools like Shodan or Censys, searching for Magento-specific fingerprints.
2. Craft malicious request: Send an HTTP GET or POST request to the target Magento store's base URL, injecting a crafted X-Original-Url header with a candidate admin path (e.g., X-Original-Url: /admin or other common admin path variations).
3. Analyze server response: Observe the HTTP response code and body — a different response (e.g., redirect, login page, or non-404 response) compared to a request without the header indicates the admin URL has been identified.
4. Enumerate admin path: Iterate over common or custom admin path patterns using the header to confirm the exact admin URL location.
5. Leverage discovered URL: Use the discovered admin URL for follow-on attacks such as brute-force login, credential stuffing, or exploitation of admin-panel vulnerabilities (OpenMage Advisory).

• Network: Unusual HTTP requests to the Magento store containing the X-Original-Url header, especially from automated tools or unfamiliar IP addresses; repeated requests probing multiple URL paths with this header.
• Logs: Web server access logs (Apache/Nginx) showing requests with X-Original-Url header values pointing to admin-like paths (e.g., /admin, /backend, /manage); high volume of such requests from a single IP may indicate automated scanning.
• Application Logs: Magento application logs showing unexpected routing or redirect behavior triggered by the X-Original-Url header during the bootstrap phase.

Upgrade openmage/magento-lts to version 20.16.1 or later (also fixed in 20.17.0), which addresses the issue by unsetting the X-Original-Url header during the bootstrap process before it is processed by the Zend library. As an immediate workaround for those unable to upgrade, administrators should configure their web server (Apache or Nginx) to strip or ignore the X-Original-Url header before it reaches the application. For Nginx, this can be done with proxy_set_header X-Original-Url ""; or equivalent directives (OpenMage Advisory, GitHub Advisory).

The vulnerability was credited to security researcher Anees Hyder (@anees0xdev) who reported it via HackerOne. The advisory notes that the underlying issue with X-Original-Url header handling in Magento has been known to some degree since 2016, referencing a historical blog post on Magento cache poisoning. No significant broader media coverage or notable community debate has been identified beyond the standard advisory publication (OpenMage Advisory).