{"action":"Upgrade openmage/magento-lts to 20.16.1 or later.","affected":[{"fixed":"20.16.1","introduced":"0"}],"component":"openmage/magento-lts","cve_ids":["CVE-2026-25523"],"ecosystem":"Packagist","epss":0.00328,"exploited":false,"fixed_versions":["20.16.1"],"ghsa_id":"GHSA-jg68-vhv3-9r8f","id":"tcs_01M5KF4J5DBC1ZZ1F3JAP6J40Z","modified_at":"2026-02-10T20:02:45.329318Z","published_at":"2026-02-02T23:12:57Z","references":["https://osv.dev/vulnerability/GHSA-jg68-vhv3-9r8f","https://github.com/OpenMage/magento-lts/security/advisories/GHSA-jg68-vhv3-9r8f","https://nvd.nist.gov/vuln/detail/CVE-2026-25523","https://github.com/OpenMage/magento-lts","https://hackerone.com/bugs?subject=openmage&report_id=3416312"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-jg68-vhv3-9r8f","url":"https://osv.dev/vulnerability/GHSA-jg68-vhv3-9r8f"}],"summary":"Magento's X-Original-Url header can expose admin url"}