CVE-2024-45148: Adobe Commerce Auth Bypass Vulnerability

CVE-2024-45148 Overview

CVE-2024-45148 is an Improper Authentication vulnerability [CWE-287] affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. The flaw allows a low-privileged attacker to bypass a security feature and gain unauthorized access without proper credentials. Exploitation requires no user interaction and can be performed over the network.

Affected releases include Adobe Commerce 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10, and earlier versions. Adobe published the fix in security bulletin APSB24-73.

Critical Impact
Successful exploitation grants an attacker unauthorized access with high impact to confidentiality, integrity, and availability of the storefront and its underlying data.

Affected Products

Adobe Commerce 2.4.4-p10, 2.4.5-p9, 2.4.6-p7, 2.4.7-p2, and earlier
Adobe Commerce B2B 1.3.3-p10, 1.3.4-p9, 1.3.5-p7, 1.4.2-p2, and earlier
Magento Open Source 2.4.4-p10, 2.4.5-p9, 2.4.6-p7, 2.4.7-p2, and earlier

Discovery Timeline

2024-10-10 - CVE-2024-45148 published to NVD following release of Adobe security bulletin APSB24-73
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-45148

Vulnerability Analysis

The vulnerability is classified as Improper Authentication [CWE-287]. Adobe Commerce fails to enforce authentication controls correctly on a protected code path. As a result, an attacker who already holds a low-privileged account can perform actions that should require higher authentication or a different identity context.

The issue is network-reachable and requires low attack complexity. No user interaction is needed to exploit it. Because the vulnerability compromises the authentication boundary, successful attacks can read, modify, or disrupt storefront data and administrative functions.

Root Cause

The root cause is an authentication check that can be circumvented under specific request conditions. The affected code paths in Adobe Commerce and Magento Open Source do not properly validate the identity or session state of the requester before granting access to protected functionality. This maps to CWE-287, Improper Authentication.

Attack Vector

Exploitation requires a low-privileged authenticated session against a vulnerable Adobe Commerce, Adobe Commerce B2B, or Magento Open Source instance exposed over the network. The attacker sends crafted requests that leverage the improper authentication check to bypass identity enforcement. Because the flaw yields a security feature bypass, the attacker can escalate access without valid administrative credentials.

No public proof-of-concept is currently listed, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.725% at the 51st percentile as of 2026-08-18.

See the Adobe Magento Security Advisory APSB24-73 for vendor technical details.

Detection Methods for CVE-2024-45148

Indicators of Compromise

Unexpected privilege changes on customer or administrative accounts, including new admin roles or permission grants.
Authentication or authorization events showing low-privileged accounts accessing administrative endpoints such as /admin, /rest/V1/, or GraphQL mutation routes.
Creation of new administrative users or API integration tokens outside of change-control windows.
Anomalous outbound requests from the Commerce application server that may indicate post-exploitation activity.

Detection Strategies

Compare the deployed Adobe Commerce or Magento version against the fixed versions listed in APSB24-73 and flag any host running an affected release.
Correlate web server access logs with authentication logs to identify sessions that access privileged endpoints without a corresponding administrative login event.
Enable and review Magento's built-in admin action logs (Enterprise) for account, role, and integration changes.

Monitoring Recommendations

Alert on repeated 401/403 responses immediately followed by 200 responses on the same endpoint from the same source, which can indicate authentication bypass probing.
Monitor for changes to the admin_user, oauth_token, and integration database tables outside of deployment windows.
Baseline normal API call volume per authenticated user and alert on outliers, particularly on B2B and checkout APIs.

How to Mitigate CVE-2024-45148

Immediate Actions Required

Upgrade Adobe Commerce and Magento Open Source to the fixed releases identified in Adobe security bulletin APSB24-73.
Inventory all Commerce, Commerce B2B, and Magento Open Source instances, including staging and development environments, and confirm each is on a patched version.
Rotate administrative credentials, API integration tokens, and OAuth secrets after patching any host that ran an affected version.
Review admin user and role tables for unauthorized entries created before the patch was applied.

Patch Information

Adobe released fixes in security bulletin APSB24-73. Administrators should apply the vendor-provided patches for Adobe Commerce (2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 or later), Adobe Commerce B2B, and Magento Open Source. Refer to the Adobe Magento Security Advisory APSB24-73 for the complete list of fixed builds and upgrade guidance.

Workarounds

Restrict access to the Magento admin panel by IP allowlist at the web server or WAF layer until patching is complete.
Enforce multi-factor authentication for all administrative accounts and disable unused API integrations.
Deploy WAF rules to block anomalous requests to administrative and REST/GraphQL endpoints from unauthenticated or low-privileged sessions.

bash

# Example: restrict admin access to trusted IPs in nginx
location ~* ^/(admin|index.php/admin) {
    allow 203.0.113.0/24;
    deny all;
    try_files $uri $uri/ /index.php?$args;
}