Critical flaw SessionReaper in Commerce and Magento platforms lets attackers hijack customer accounts

Adobe has fixed a critical vulnerability in its Commerce and Magento Open Source platforms, tracked as CVE-2025-54236 (also known as SessionReaper) with a CVSS score of 9.1, described as an improper input validation flaw that can enable customer account takeover and unauthenticated remote code execution under certain conditions. An attacker could take over customer accounts through the Commerce REST API, and Sansec notes that the flaw is among the more severe Magento vulnerabilities in recent history.

The advisory lists affected products and versions across Adobe Commerce, Adobe Commerce B2B and Magento Open Source, including multiple 2.x releases and specific older branches, as well as the Custom Attributes Serializable module versions 0.1.0 to 0.4.0.

The researcher blaklis reported the issue to Adobe, and Adobe says it is not aware of any active exploitation in the wild; according to Sansec, there are likely multiple exploit vectors and the risk persists across storage types, prompting immediate action for merchants using Redis or database sessions. The article was published on 10 September 2025.