CVE-2026-128049: Critical CSRF in OpenMage Magento LTS — OAuth Token Theft Detection and Remediation Guide

---
title: OpenMage OAuth Confirm CSRF Exploitation Attempt
id: a1b2c3d4-1280-4e5f-a6b7-c8d9e0f1a2b3
status: experimental
description: Detects GET requests to the vulnerable OAuth confirm or confirmSimple endpoints in OpenMage Magento LTS, which may indicate a CSRF exploitation attempt per CVE-2026-128049. These endpoints should not normally receive GET requests from external sources without a valid form key.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-128049
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|contains:
      - '/oauth/confirm'
      - '/oauth/confirmSimple'
  selection_method:
    cs-method: 'GET'
  condition: selection_uri and selection_method
falsepositives:
  - Legitimate OAuth confirmation flows that use GET requests in the vulnerable versions
  - Health checks or monitoring tools hitting OAuth endpoints
level: high
---
title: OpenMage OAuth Token Exchange from External Source
id: b2c3d4e5-1280-4f6a-b7c8-d9e0f1a2b3c4
status: experimental
description: Detects POST requests to the OpenMage /oauth/token endpoint from external or non-whitelisted IP addresses. After a successful CSRF attack per CVE-2026-128049, the attacker exchanges the authorized request token for a persistent access token at this endpoint.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-128049
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1550
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|contains: '/oauth/token'
  selection_method:
    cs-method: 'POST'
  condition: selection_uri and selection_method
falsepositives:
  - Legitimate OAuth token exchanges from authorized integrations and third-party applications
  - Internal API consumers performing scheduled token refreshes
level: medium
---
title: Suspicious REST API Activity via Stolen OAuth Token
id: c3d4e5f6-1280-4a7b-c8d9-e0f1a2b3c4d5
status: experimental
description: Detects REST API requests to sensitive OpenMage endpoints (customers, orders, admin operations) that originate from IP addresses not associated with known OAuth consumers. This may indicate use of a stolen persistent access token obtained via CVE-2026-128049.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-128049
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1213
  - attack.impact
logsource:
  category: webserver
detection:
  selection_api:
    cs-uri-stem|contains:
      - '/api/rest/customers'
      - '/api/rest/orders'
      - '/api/rest/products'
      - '/api/rest/admin'
  selection_auth:
    cs-method:
      - 'GET'
      - 'POST'
      - 'PUT'
      - 'DELETE'
  condition: selection_api and selection_auth
falsepositives:
  - Legitimate API consumers including ERP integrations, inventory management, and reporting tools
  - Mobile applications using REST API for storefront functionality
level: medium

// Hunt 1: Identify GET requests to vulnerable OAuth confirm endpoints (CSRF delivery)
CommonSecurityLog
| where TimeGenerated > ago(30d)
| where RequestURL has_any ("/oauth/confirm", "/oauth/confirmSimple")
| where RequestMethod == "GET"
| project TimeGenerated, SourceIP, RequestURL, RequestMethod, RequestContext, DeviceAction
| sort by TimeGenerated desc

// Hunt 2: Correlate OAuth confirm GET requests with subsequent token exchanges from different IPs
let ConfirmEvents = CommonSecurityLog
| where TimeGenerated > ago(7d)
| where RequestURL has_any ("/oauth/confirm", "/oauth/confirmSimple")
| where RequestMethod == "GET"
| project ConfirmTime=TimeGenerated, VictimIP=SourceIP, RequestURL;
let TokenEvents = CommonSecurityLog
| where TimeGenerated > ago(7d)
| where RequestURL has "/oauth/token"
| where RequestMethod == "POST"
| project TokenTime=TimeGenerated, AttackerIP=SourceIP, TokenURL=RequestURL;
ConfirmEvents
| join kind=inner TokenEvents on $left.ConfirmTime < $right.TokenTime
| where TokenTime between (ConfirmTime .. ConfirmTime + 1h)
| where VictimIP != AttackerIP
| project ConfirmTime, VictimIP, TokenTime, AttackerIP, RequestURL, TokenURL
| sort by ConfirmTime desc

// Hunt 3: Detect anomalous REST API access patterns (potential stolen token usage)
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where RequestURL has "/api/rest/"
| where RequestMethod in ("GET", "POST", "PUT", "DELETE")
| summarize APICallCount = count(), UniqueEndpoints = dcount(RequestURL), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, bin(TimeGenerated, 1h)
| where APICallCount > 100
| sort by APICallCount desc

-- Hunt for evidence of OAuth token abuse in web server access logs
-- Targets Apache and Nginx access logs for suspicious OAuth endpoint activity
SELECT FullPath, Line,
       timestamp(string=parse_string_to_array(string=Line, regex="\\[(\\d+/\\w+/\\d+:\\d+:\\d+:\\d+)")[0], format="02/Jan/2006:15:04:05") AS LogTime
FROM glob(globs=["/var/log/apache2/access*.log", "/var/log/nginx/access*.log", "/var/log/httpd/access*.log"])
WHERE Line =~ "oauth/(confirm|confirmSimple|token)"
   AND Line =~ "GET"
ORDER BY LogTime DESC
LIMIT 1000

#!/bin/bash
# CVE-2026-128049 Detection and Remediation Script for OpenMage Magento LTS
# Run on the web server hosting OpenMage

set -euo pipefail

OPENMAGE_ROOT="${1:-/var/www/html}"
echo "=============================================="
echo " CVE-2026-128049 OpenMage OAuth CSRF Checker"
echo "=============================================="
echo ""

# Step 1: Identify OpenMage version
echo "[STEP 1] Identifying OpenMage Magento LTS version..."
if [ -f "${OPENMAGE_ROOT}/app/Mage.php" ]; then
    VERSION=$(grep -oP "getVersionInfo.*?'major'\\\s*=>\\\s*'\\K[^']+" "${OPENMAGE_ROOT}/app/Mage.php" 2>/dev/null || echo "unknown")
    echo "  Found app/Mage.php"
else
    echo "  WARNING: app/Mage.php not found at ${OPENMAGE_ROOT}"
    echo "  Checking composer.json for version info..."
    if [ -f "${OPENMAGE_ROOT}/composer.json" ]; then
        grep -i version "${OPENMAGE_ROOT}/composer.json" | head -5
    fi
fi

# Check for version in composer.lock if available
if [ -f "${OPENMAGE_ROOT}/composer.lock" ]; then
    echo "  Checking composer.lock for openmage version..."
    grep -A2 '"openmage' "${OPENMAGE_ROOT}/composer.lock" | head -10
fi

echo ""
echo "[STEP 2] Checking for OAuth tokens in database..."
echo "  Connect to your MySQL/MariaDB database and run:"
echo ""
echo "  SELECT token, secret, consumer_key, created_at, updated_at"
echo "  FROM oauth_token"
echo "  ORDER BY created_at DESC;"
echo ""
echo "  Look for tokens with recent creation dates that you cannot attribute"
echo "  to known integrations or user actions."
echo ""

# Step 3: Check web server access logs for exploitation attempts
echo "[STEP 3] Scanning web server access logs for OAuth confirm GET requests..."
LOG_DIRS=("/var/log/apache2" "/var/log/nginx" "/var/log/httpd")
FOUND_LOGS=false

for LOG_DIR in "${LOG_DIRS[@]}"; do
    if [ -d "${LOG_DIR}" ]; then
        echo "  Scanning ${LOG_DIR}/access*.log* for OAuth endpoint access..."
        MATCHES=$(zgrep -h "GET.*oauth/\(confirm\|confirmSimple\)" "${LOG_DIR}"/access*.log* 2>/dev/null || true)
        if [ -n "${MATCHES}" ]; then
            FOUND_LOGS=true
            echo ""
            echo "  !!! POTENTIAL EXPLOITATION ATTEMPTS FOUND !!!"
            echo ""
            echo "${MATCHES}" | tail -20
            echo ""
        else
            echo "  No GET requests to oauth/confirm endpoints found in ${LOG_DIR}"
        fi
    fi
done

if [ "$FOUND_LOGS" = false ]; then
    echo "  No web server access logs found in standard locations."
    echo "  Manually check your access logs for: GET /oauth/confirm or GET /oauth/confirmSimple"
fi

echo ""
echo "[STEP 4] Checking for /oauth/token POST activity..."
for LOG_DIR in "${LOG_DIRS[@]}"; do
    if [ -d "${LOG_DIR}" ]; then
        TOKEN_MATCHES=$(zgrep -h "POST.*oauth/token" "${LOG_DIR}"/access*.log* 2>/dev/null || true)
        if [ -n "${TOKEN_MATCHES}" ]; then
            echo "  POST requests to /oauth/token found:"
            echo "${TOKEN_MATCHES}" | tail -10
            echo ""
        fi
    fi
done

echo ""
echo "[STEP 5] Checking for vulnerable OAuth controller files..."
OAUTH_CONTROLLER=$(find "${OPENMAGE_ROOT}" -path "*/oauth*" -name "*.php" -path "*/controllers/*" 2>/dev/null | head -5)
if [ -n "${OAUTH_CONTROLLER}" ]; then
    echo "  Found OAuth controller files:"
    echo "${OAUTH_CONTROLLER}"
    echo ""
    echo "  Checking for form key validation in confirm actions..."
    for FILE in ${OAUTH_CONTROLLER}; do
        if grep -q "confirmAction\|confirmSimpleAction" "${FILE}" 2>/dev/null; then
            echo "  --- ${FILE} ---"
            if grep -q "validateFormKey\|_validateFormKey\|form_key" "${FILE}" 2>/dev/null; then
                echo "  [OK] Form key validation appears to be present."
            else
                echo "  [VULNERABLE] No form key validation found in confirm actions!"
            fi
        fi
    done
else
    echo "  Could not locate OAuth controller files."
fi

echo ""
echo "=============================================="
echo " RECOMMENDED ACTIONS"
echo "=============================================="
echo " 1. Update OpenMage to version 20.18.2 or 21.0.0-beta3+"
echo " 2. Revoke ALL existing OAuth access tokens in the admin panel"
echo " 3. Force re-authorization for all legitimate OAuth consumers"
echo " 4. Review access logs for signs of exploitation (see Step 3)"
echo " 5. If exploitation is suspected, initiate incident response"
echo "=============================================="