CVE-2026-42155: Magento LTS has Weak API Session ID — Predictable MD5 of Time-Derived Inputs

May 5, 2026 (updated May 15, 2026)

The XML-RPC / SOAP API session ID is generated using an outdated, time-based construction rather than a Cryptographically Secure Pseudo-Random Number Generator (CSPRNG):

The XML-RPC / SOAP API session ID is generated using an outdated, time-based construction rather than a Cryptographically Secure Pseudo-Random Number Generator (CSPRNG):

All inputs to the MD5 hash are time-derived and non-secure:

References

github.com/OpenMage/magento-lts/security/advisories/GHSA-2cwr-gcf9-pvxr
github.com/advisories/GHSA-2cwr-gcf9-pvxr
nvd.nist.gov/vuln/detail/CVE-2026-42155

Code Behaviors & Features

Detect and mitigate CVE-2026-42155 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →