CVE-2026-48000

Adobe Commerce is affected by an Improper Redirect (Open Redirect) vulnerability that could result in a Security feature bypass. An attacker could construct a malicious URL that redirects a victim to an attacker-controlled site. Exploitation of this issue requires user interaction in that a victim must click on a malicious link. Scope is changed.

Score

CVSS 3.1 6.1 Medium

Status

Analyzed - psirt@adobe.com

Published

2026-07-14

Last modified

2026-08-27

Weaknesses

CWE-601

Affected products

• Adobe Commerce (Adobe)
• Adobe Commerce B2b (Adobe)
• Adobe Commerce Events (Adobe)
• Commerce (Adobe)
• Commerce B2b (Adobe)
• I/o Events (Adobe)
• Magento (Adobe)
• Magento Open Source (Adobe)

References

• https://helpx.adobe.com/security/products/magento/apsb26-73.html