EUVD-2026-44418
GHSA-8mmj-xmj8-554p
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-accessible, no auth required, but mandatory victim click; changed scope captures cross-origin phishing; no availability impact applies.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
3DescriptionCVE.org
Adobe Commerce is affected by an Improper Redirect (Open Redirect) vulnerability that could result in a Security feature bypass. An attacker could construct a malicious URL that redirects a victim to an attacker-controlled site, potentially enabling credential theft and account takeover. Exploitation of this issue requires user interaction in that a victim must click on a malicious link.
AnalysisAI
Open redirect in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin allows remote unauthenticated attackers to construct malicious URLs that silently forward victims to attacker-controlled phishing sites, enabling credential theft and account takeover. The flaw spans the full product family across multiple supported version branches and was disclosed by Adobe via Security Bulletin APSB26-73 with patches released in July 2026. No public exploit code has been identified at time of analysis, and SSVC rates exploitation status as 'none' with EPSS at 0.74% (50th percentile), indicating limited real-world exploitation signal despite broad product prevalence.
Technical ContextAI
Adobe Commerce (and its open-source fork Magento Open Source) is a PHP-based e-commerce platform widely deployed for enterprise and SMB storefronts. The root cause is CWE-601 (URL Redirection to Untrusted Site / Open Redirect), a class of flaw where the application accepts user-supplied destination URLs in redirect parameters without adequate allowlist validation, causing the server to honor arbitrary external redirect targets. The CVSS Changed Scope metric (S:C) reflects that the security boundary crossed is not the server itself but the victim's browser trust context - the application's domain reputation is weaponized to launder a redirect to attacker infrastructure. Affected CPE strings confirm all four product lines: cpe:2.3:a:adobe:adobe_commerce, cpe:2.3:a:adobe:adobe_commerce_b2b, cpe:2.3:a:adobe:magento_open_source, and cpe:2.3:a:adobe:adobe_commerce_webhooks_plugin. The Webhooks Plugin's inclusion suggests redirect logic may also be present in integration or callback URL handling, widening the attack surface beyond core storefront flows.
RemediationAI
Vendor-released patches are available per Adobe Security Bulletin APSB26-73 (https://helpx.adobe.com/security/products/magento/apsb26-73.html). Upgrade Adobe Commerce to the corresponding July 2026 release for the installed branch: 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, or 2.4.4-2026-jul. Upgrade Adobe Commerce B2B to 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, or 1.3.3-2026-jul as applicable. Upgrade Magento Open Source to 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, or 2.4.6-2026-jul. Upgrade the Adobe Commerce Webhooks Plugin to version 1.21.0. Where immediate patching is not feasible, deploy a WAF rule to block redirect parameters containing absolute external URLs (trade-off: may break legitimate third-party checkout integrations that use redirect flows). Adding strict referrer-policy and Content-Security-Policy headers reduces phishing page effectiveness but does not prevent the redirect itself. User awareness communications about suspicious Commerce-branded links are a low-friction supplemental control.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today