Cross-site request forgery in magento-lts - #VU158635
Published: November 2, 2026
Vulnerability details
The vulnerability allows a remote attacker to delete a customer's authorized OAuth applications or re-enable a previously revoked application without the customer's consent.
The vulnerability exists due to missing cross-site request forgery protection in Mage_Oauth_Customer_TokenController when handling OAuth application revocation and deletion requests. A remote attacker can trick a logged-in customer into loading attacker-controlled content that triggers a GET request to oauth/customer_token/revoke or oauth/customer_token/delete without form-key validation to delete an authorized application or re-enable a revoked application.
Exploitation requires the merchant to have enabled customer OAuth (REST) access.