Magento LTS has Weak API Session ID — Predictable MD5 of Time-Derived Inputs
Date: 2026-05
Affected: composer/openmage/magento-lts
Attack vector: other
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2026-42155
CWE: CWE-330
CWE-331
CWE-338

Affected Version: OpenMage LTS ≤ 20.16.0 (confirmed on `20.16.0`) Affected File: `https://github.com/OpenMage/magento-lts/blob/main/app/code/core/Mage/Api/Model/Session.php` – `start()` method ## Summary The XML-RPC / SOAP API session ID is generated using an outdated, time-based construction rather than a Cryptographically Secure Pseudo-Random Number Generator (CSPRNG): ```php The XML-RPC / SOAP API session ID is generated using an outdated, time-based construction rather than a Cryptographically Secure Pseudo-Random Number Generator (CSPRNG): ``` All inputs to the MD5 hash are time-derived and non-secure: | Input | Value | Predictability | |----------------------------|---------------------------------------------------|----------------------------------------| | `time()` | Unix timestamp (seconds) | Fully predictable | | `uniqid('', true) prefix` | `sprintf('%08x%05x', $sec, $usec/10)` | Highly predictable via network timing | | `uniqid('', true) suffix` | `php_combined_lcg()` decimal float | Process-state dependent (`getpid() ^ time()`) | | `$sessionName` | `null` (empty) — called without arg | Constant | Because the resulting digest relies entirely on the timestamp and the PHP internal LCG state, the effective entropy is severely


Mitigations:

Architectural layers (MAESTRO):