CVE-2025-54236: Adobe Commerce Auth Bypass Vulnerability

CVE-2025-54236 Overview

CVE-2025-54236, publicly tracked as "SessionReaper," is an improper input validation vulnerability ([CWE-20]) affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. The flaw allows an unauthenticated remote attacker to abuse the REST API to achieve session takeover against affected storefronts. Exploitation requires no user interaction and no privileges.

The vulnerability impacts Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15, and earlier. CISA added CVE-2025-54236 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active in-the-wild exploitation against internet-facing Magento and Commerce storefronts.

Critical Impact

Unauthenticated attackers can hijack customer and administrative sessions across Adobe Commerce storefronts, leading to account takeover, order tampering, and potential downstream code execution.

Affected Products

• Adobe Commerce 2.4.4 through 2.4.4-p15, 2.4.5 through 2.4.5-p14, 2.4.6 through 2.4.6-p12, 2.4.7 through 2.4.7-p7, 2.4.8 through 2.4.8-p2, and 2.4.9-alpha2
• Adobe Commerce B2B 1.3.3 through 1.5.3-alpha2
• Magento Open Source 2.4.5 through 2.4.9-alpha2

Discovery Timeline

• 2025-09-09 - CVE-2025-54236 published to the National Vulnerability Database
• 2025-09-09 - Adobe publishes security advisory APSB25-88 with patches
• 2026-05-12 - Last updated in NVD database

Technical Details for CVE-2025-54236

Vulnerability Analysis

The vulnerability resides in how Adobe Commerce processes nested data structures submitted to its REST API endpoints. Improper input validation on serialized request payloads allows an attacker to inject crafted objects that influence session storage. The result is a session takeover primitive that the attacker can use without authenticating to the application.

Public technical analysis describes the issue as a nested deserialization weakness in the Commerce REST framework. By abusing how the Webapi component handles certain parameter types, an attacker can read or write arbitrary session files on the filesystem backend used by Commerce installations. Where file-based sessions are present, this primitive has been chained into unauthenticated remote code execution.

Root Cause

The root cause is missing validation of user-controlled input passed into the REST API serialization layer. The Webapi service trusts client-supplied type and structure metadata when reconstructing request objects. This trust allows an attacker to control downstream operations against session storage, breaking the integrity boundary between unauthenticated request data and trusted server-side state.

Attack Vector

Exploitation occurs over the network against any exposed Commerce or Magento storefront. The attacker sends a crafted HTTP request to a public REST API endpoint, with no authentication or user interaction required. Successful exploitation yields the ability to hijack arbitrary sessions, including administrator sessions, which grants full control of the storefront backend.

For technical details on the exploitation chain, refer to the Null Security X analysis of CVE-2025-54236 and the Adobe Security Advisory APSB25-88.

Detection Methods for CVE-2025-54236

Indicators of Compromise

• Unusual POST requests to /rest/V1/ and /rest/default/V1/ endpoints containing nested object payloads or unexpected __type__ or model parameters.
• Unexpected files written to the var/session/ directory or modifications to PHP session files outside normal application activity.
• Administrator logins from new geolocations or user agents without a preceding successful authentication event in the audit log.
• New admin users, modified payment configurations, or injected JavaScript in CMS blocks following anomalous REST traffic.

Detection Strategies

• Inspect web server access logs for unauthenticated requests to REST endpoints carrying serialized payloads with unusual size or structure.
• Correlate REST API traffic with session file modifications using file integrity monitoring on the Commerce server.
• Hunt for outbound connections initiated by the PHP-FPM or web server process to non-business destinations after suspicious REST calls.
• Review Adobe Commerce admin audit logs for privilege changes that lack a corresponding authenticated login event.

Monitoring Recommendations

• Enable verbose Webapi logging and forward web, application, and session storage telemetry to a centralized analytics platform for correlation.
• Deploy WAF rules from Adobe's hotfix bundle and alert on any blocked request matching the SessionReaper signatures.
• Monitor for newly created PHP files under pub/, app/, or var/ paths, which can indicate post-exploitation webshell deployment.

How to Mitigate CVE-2025-54236

Immediate Actions Required

• Apply the Adobe VULN-32437-2-4-X-patch hotfix or upgrade to a fixed Commerce or Magento release as documented in APSB25-88.
• Restrict access to /rest/ API endpoints at the WAF or reverse proxy where business workflows do not require public exposure.
• Rotate all administrator credentials and invalidate active sessions after patching to evict any pre-existing attacker foothold.
• Audit admin users, integrations, and scheduled tasks for unauthorized changes introduced before remediation.

Patch Information

Adobe released fixed builds and an out-of-band hotfix on September 9, 2025. Administrators should consult the Adobe Security Advisory APSB25-88 and the Adobe Knowledge Base article for SessionReaper for version-specific patch packages. The KEV listing is tracked in the CISA Known Exploited Vulnerabilities Catalog.

Workarounds

• Deploy Adobe's published WAF rules to block the known SessionReaper request patterns until full patching is complete.
• Switch session storage from file-based to Redis or database backends to disrupt the file-write exploitation path.
• Block or rate-limit unauthenticated REST API access at the perimeter for endpoints not required by public storefront flows.

# Example: apply the Adobe hotfix and clear caches after patching
cd /var/www/html
unzip VULN-32437-2-4-X-patch.zip
patch -p1 < VULN-32437-composer.patch
bin/magento setup:upgrade
bin/magento cache:flush
bin/magento cache:clean