Adobe Commerce Open Redirect Vulnerability Allowing Security Feature Bypass

A vulnerability allowing improper redirection (open redirect) has been identified in Adobe Commerce. This issue could lead to a security feature bypass, as it allows an attacker to create a malicious URL that redirects a victim to an attacker-controlled site. Such redirection could facilitate credential theft and account takeover. Exploitation of this vulnerability requires user interaction, as the victim must click on the malicious link. The vulnerability affects multiple versions of Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and Adobe Commerce Events.

Impact

Exploitation of this vulnerability could result in a security feature bypass, potentially allowing for credential theft and account takeover.

Remediation

Users are advised to update to the latest versions of Adobe Commerce, Adobe Commerce B2B, Magento Open Source, or Adobe Commerce Events. Instructions for updating can be found in the Adobe Security Bulletin APSB26-73.