Magento's X-Original-Url header can expose admin url
Impact
The admin url can be discovered without prior knowledge of it's location by exploiting the X-Original-Url header on some configurations.
Patches
The bug comes from the Zend library and is patche by unsetting the header in the bootstrap process.
Workarounds
Unset the X-Original-Url header in the web server configuration.
References
The activation of these headers is coming from the Zend_Controller module. It appears this has been known to some degree since 2016 - https://peterocallaghan.co.uk/2016/12/magento-poisoning-cache/ (dead link now..)
Credit
Anees Hyder ( @anees0xdev ) via HackerOne https://hackerone.com/anees0x_dev/hacktivity
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | openmage/magento-lts | < 20.16.1 | 20.16.1 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N- Weakness (CWE)
CWE-200- Platform
- Composer
- Package
openmage/magento-lts- Disclosed
- 02.02.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-jg68-vhv3-9r8f - CC BY 4.0
Vulnerability history: openmage/magento-lts
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 26
- First → latest
- 08.2020 05.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 3
- High 12
- Medium 10
- Low 1
Disclosures per year
- 2020: 2
- 2021: 4
- 2022: 0
- 2023: 8
- 2024: 2
- 2025: 2
- 2026: 8
-
Magento's X-Original-Url header can expose admin url this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.