Magento LTS Vulnerable to Open Redirect via Unvalidated `uenc` Parameter in `stockAction()`
Date: 2026-05
Affected: composer/openmage/magento-lts
Attack vector: other
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-42207
CWE: CWE-601
CVSS: 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

## Summary `Mage_ProductAlert_AddController::stockAction()` reads the uenc query parameter and passes it directly to `$this->_redirectUrl($backUrl)` without calling `$this->_isUrlInternal()` When the supplied `product_id` does not match any catalog product, the server issues an unvalidated HTTP 302 redirect to whatever URL was provided as `uenc`. ## Vulnerable path: ```php // app/code/core/Mage/ProductAlert/controllers/AddController.php : stockAction() $backUrl = $this->getRequest()->getParam(Mage_Core_Controller_Front_Action::PARAM_NAME_URL_ENCODED); // raw, no decode $productId = (int) $this->getRequest()->getParam('product_id'); if (!$backUrl || !$productId) { $this->_redirect('/'); return; } $product = Mage::getModel('catalog/product')->load($productId); if (!$product->getId()) { $session->addError($this->__('Not enough parameters.')); $this->_redirectUrl($backUrl); // ← NO _isUrlInternal() check return; } ``` ### Secure peer (priceAction()): ```php if (!$product->getId()) { if ($this->_isUrlInternal($backUrl)) { // ← validation present $this->_redirectUrl($backUrl); } else { $this->_redirect('/'); } return; } ``` ## Steps to Reproduce ### Prerequisites - OpenMage LTS ≤ 20.16.0 with Product Alerts enabled (default configuration) - A valid, logged-in customer session on the target store #### Step 1 – Authenticate as a Customer (Attacker controls the crafted link; victim must be logged in) The `preDispatch(


Mitigations:

Architectural layers (MAESTRO):