Adobe Commerce | Improper Input Validation (CWE-20)

Adobe Commerce has a flaw that fails to properly check user input, allowing attackers to take over customer or admin sessions without any user action. This gives attackers full access to accounts and sensitive data.

Improper input validation in affected Adobe Commerce versions (2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier) enables unauthenticated session hijacking. The vulnerability allows attackers to craft malicious input that bypasses validation controls, leading to unauthorized session establishment without requiring user interaction, resulting in high confidentiality and integrity impact.