SessionReaper (CVE-2025-54236): Critical Adobe Commerce and Magento Vulnerability

Adobe Issues Warning About the "SessionReaper" Vulnerability

Adobe has warned of a critical vulnerability in Adobe Commerce and Magento Open Source. The flaw is tracked as CVE-2025-54236 and nicknamed "SessionReaper." It has a CVSS score of 9.1, which rates it as critical.

What Is the Threat?

The vulnerability comes from improper input validation. It lets an attacker take over customer accounts through the Commerce REST API. The attack is not complicated to carry out, and it can do serious damage to online stores running on these platforms.

Many versions of Adobe Commerce and Magento Open Source are affected, along with the Custom Attributes Serializable module (versions 0.1.0–0.4.0).

Remediation and Risk Assessment

No active exploitation has been reported so far. Even so, Adobe has already released a hotfix and deployed WAF (Web Application Firewall) rules to protect its cloud customers.

E-commerce security firm Sansec called "SessionReaper" one of the most severe vulnerabilities in Magento's history. It puts the flaw in the same league as Shoplift (2015), TrojanOrder (2022) and CosmicSting (2024).

Read also: A Comprehensive Guide to Zero-Day Vulnerabilities and our roundup of the week's critical vulnerabilities.