Skip to content
CVE PROGRAM SOURCE RECORD6.1 Medium

CVE-2026-48000

Adobe Commerce | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
adobe

Description

Adobe Commerce is affected by an Improper Redirect (Open Redirect) vulnerability that could result in a Security feature bypass. An attacker could construct a malicious URL that redirects a victim to an attacker-controlled site. Exploitation of this issue requires user interaction in that a victim must click on a malicious link. Scope is changed.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Adobe Adobe Commerce

Default version status: unaffected

  • 0 to ≤ 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18affected
  • 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, 2.4.4-2026-julunaffected

Adobe Adobe Commerce B2B

Default version status: unaffected

  • 0 to ≤ 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18affected
  • 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-julunaffected

Adobe Magento Open Source

Default version status: unaffected

  • 0 to ≤ 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15affected
  • 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-julunaffected

Adobe Adobe Commerce Events

Default version status: unaffected

  • 0 to ≤ 1.20.0affected
  • 1.21.0unaffected

References