Insufficient Session Expiration in magento-lts - #VU158614
Published: November 2, 2026
Vulnerability details
The vulnerability allows a remote privileged user to retain REST API access after admin account deactivation and continue reading and modifying data permitted by the user's existing REST role.
The vulnerability exists due to insufficient OAuth token invalidation and missing admin account status checks in Mage_Api2_Model_Auth_User_Admin::getRole() and Mage_Oauth_Model_Server::checkAccessRequest() when authorizing REST API requests. A remote privileged user can submit requests using an OAuth access token issued while the admin account was active to continue accessing the REST API after that account is deactivated.
The issue is restricted to admin REST access; customer REST access is unaffected, and deleting a customer or admin deletes its tokens.