CVE-2026-82190: J2Store Authentication Bypass Vulnerability

CVE-2026-82190 Overview

CVE-2026-82190 affects the J2Store extension for Joomla, developed by j2commerce.com. The vulnerability stems from a predictable and forgeable order access token in vulnerable J2Store releases. An attacker who obtains the Joomla site secret through any separate disclosure vector can compute a valid guest access token for any order on the site. This grants unauthorized access to order details and any purchased digital downloads without ever having placed an order.

Critical Impact
Token exposure persists indefinitely because the token is never rotated, even after the underlying secret-disclosure vector is patched, unless the Joomla secret itself is rotated.

Affected Products

J2Store 1.0.0 through 3.3.2
J2Store 4.0.0 through 4.0.22
J2Store 4.1.0 through 4.1.7

Discovery Timeline

2026-09-15 - CVE-2026-82190 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-82190

Vulnerability Analysis

J2Store generates guest order access tokens using a deterministic function that incorporates the Joomla site secret as its keying material. Because the derivation is predictable, anyone in possession of the secret can reproduce a valid token for any order identifier on the site. The token functions as a bearer credential for the guest download and order-review flow. J2Store does not rotate the token when the order is viewed, when the secret changes, or on any other lifecycle event.

This design produces a persistent authorization bypass. An attacker enumerates order IDs and computes tokens offline, then retrieves order data and any associated digital download links. The classification aligns with [CWE-1241: Use of Predictable Algorithm in Random Number Generator] and represents a broken access control pattern for guest resources.

Root Cause

The root cause is reliance on a static, site-wide value (the Joomla secret) as the sole cryptographic input for per-order token generation. Once the secret is exposed through a separate vulnerability, all past and future order tokens become computable. The absence of a per-order random component and the lack of token rotation compound the exposure.

Attack Vector

Exploitation requires the attacker to first obtain the Joomla secret through a distinct disclosure vector. This dependency raises attack complexity and is why the vulnerability is not directly exploitable by an anonymous visitor with no other foothold. Once the secret is known, the attacker constructs order access URLs remotely over the network without authentication or user interaction.

No verified proof-of-concept code is publicly available. See the J2Commerce Security Overview for vendor guidance.

Detection Methods for CVE-2026-82190

Indicators of Compromise

Unexpected HTTP GET requests to J2Store order-view or digital-download endpoints containing a token parameter, originating from IPs that never completed a checkout.
Guest order access events for order IDs enumerated in sequence within a short time window.
Access to digital download URLs by clients with no prior session, referrer, or purchase confirmation email interaction.

Detection Strategies

Correlate web server access logs against the J2Store #__j2store_orders table to identify order views with no matching purchaser session or email confirmation click.
Alert on high-rate iteration of numeric order identifiers against J2Store guest access endpoints.
Monitor filesystem or CDN egress logs for downloads of protected digital goods without a preceding authenticated purchase event.

Monitoring Recommendations

Enable Joomla's built-in logging for J2Store components and forward events to a centralized log platform for retention and correlation.
Baseline normal order-view request volumes per source IP and per order ID, then alert on deviations.
Audit any historical exposure of the Joomla configuration.php file or the $secret value through backups, misconfigured web servers, or prior vulnerabilities.

How to Mitigate CVE-2026-82190

Immediate Actions Required

Upgrade J2Store to a fixed release above the affected 3.3.2, 4.0.22, and 4.1.7 versions as listed by the vendor.
Rotate the Joomla site secret in configuration.php after patching. Patching alone does not invalidate previously computable tokens.
Audit access logs for prior enumeration of order-access endpoints and notify affected customers if unauthorized access is confirmed.

Patch Information

Refer to the J2Commerce Security Overview for the current fixed version and upgrade instructions. Apply the vendor patch to all Joomla installations running affected J2Store versions.

Workarounds

Restrict access to J2Store order-view and digital-download endpoints at the web application firewall until the extension is upgraded and the secret rotated.
Regenerate the Joomla secret value on any site suspected of prior configuration.php exposure, and invalidate active guest download links.
Move digital download delivery behind an authenticated customer account flow where feasible, rather than guest tokenized URLs.

bash

# Rotate the Joomla secret in configuration.php after patching J2Store
# Back up configuration.php first, then replace the $secret value
php -r "echo bin2hex(random_bytes(16)) . PHP_EOL;"
# Edit configuration.php and set: public $secret = '<new-value>';