OpenMage magento-lts before version 20.18.0 contains an open redirect vulnerability in the Mage_ProductAlert_AddController::stockAction() method. The method reads the 'uenc' query parameter and passes it directly to the internal redirect function without verifying if the URL is internal. If the product_id parameter does not correspond to any product in the catalog, the server issues an HTTP 302 redirect to the URL specified in 'uenc', enabling an attacker to redirect users to arbitrary external sites. This vulnerability is addressed in version 20.18.0.

Successful exploitation allows an attacker to redirect users to arbitrary external URLs, potentially facilitating phishing attacks or other social engineering tactics. The CVSS 3.1 base score is 6.1 (medium severity), reflecting the network attack vector, low attack complexity, no privileges required, user interaction required, and partial impact on confidentiality and integrity. There is no indication of availability impact or known exploits in the wild.

Upgrade OpenMage magento-lts to version 20.18.0 or later, where this vulnerability is fixed. Since no official patch link or vendor advisory is provided, verify the upgrade from the official OpenMage project sources. Until upgraded, avoid using affected versions in environments where untrusted input could be passed to the vulnerable endpoint.