CVE-2026-128042

EUVD-2026-125066
OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains a race condition in shopping cart price rule usage limits, because Mage_SalesRule_Model_Validator checks coupon limits without locking and the usage counters are later incremented non-atomically. Unauthenticated attackers, including guest shoppers, can submit concurrent checkouts to redeem a limited coupon more times than its cap allows.
Race Condition
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
3.7 LOW
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 21.09%
Common Weakness Enumeration
References
https://github.com/OpenMage/magento-lts/commit/2626f027a752cda004c5cf7f8f9bd3cf52f525f2
https://github.com/OpenMage/magento-lts/security/advisories/GHSA-5rg7-22cv-c9q6
https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.19.0-race-condition-in-coupon-usage-limits