Threats tagged 'ghsa-q785-9ghr-8qj7'

OpenMage magento-lts versions before 20.18.2 and 21.0.0-beta pre-releases before 21.0.0-beta3 use weak methods to generate customer email confirmation keys and password-reset tokens. The keys are generated using md5(uniqid()) and uniqHash(), which are not cryptographically secure. This allows unauthenticated attackers to brute-force confirmation keys via an unrate-limited endpoint, potentially logging in as pending customers or predicting administrator reset tokens after recovering the generator state.