Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Magento-lts is a long-term support alternative to Magento Community Edition (CE). Prior to version 20.16.1, the admin url can be discovered without prior knowledge of it's location by exploiting the X-Original-Url header on some configurations. This issue has been patched in version 20.16.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-04 | 1 | Patch1 |
| 2026-02-12 | 2 | Disclosure1General1 |
Just got my first CVE from a HackerOne report - CVE-2026-25523 Grateful to be contributing to real-world security in open-source software. More coming. 💻🔐 #cve #hackerone #cybersecurity #BugBounty
Post summary
A user announces that they have received a new CVE (CVE-2026-25523) from a HackerOne report and plans to report more in the future.
@itspraveen70140 @ni5arga I once got a CVE from a website issue, it depends on the issue. https://www.cve.org/CVERecord?id=CVE-2026-25523
https://nvd.nist.gov/vuln/detail/CVE-2026-25523 https://github.com/advisories/GHSA-jg68-vhv3-9r8f
Post summary
The text consists solely of two URLs pointing to CVE references, with no additional context or actionable information provided.
CVE-2026-25523 Magento-lts is a long-term support alternative to Magento Community Edition (CE). Prior to version 20.16.1, the admin url can be discovered without prior knowledge of… https://www.cve.org/CVERecord?id=CVE-2026-25523
Post summary
CVE-2026-25523 allows discovery of the Magento admin URL in versions before 20.16.1; the issue is fixed in v20.16.1.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openmage | magento | - | - | - |