CVE-2026-21295 PUBLISHED

Adobe Commerce | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)

Assigner: adobe
Reserved: 12.12.2025 Published: 11.03.2026 Updated: 11.03.2026

Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. An attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS Score: 3.1

Attack Vector	Network	Scope	Unchanged
Attack Complexity	High	Confidentiality Impact	None
Privileges Required	None	Integrity Impact	Low
User Interaction	Required	Availability Impact	None

CVSS 3.1

Product Status

Vendor	Adobe
Product	Adobe Commerce
Versions	Default: affected affected from 0 to 2.4.4-p16 (incl.)

References

https://helpx.adobe.com/security/products/magento/apsb26-05.html

Problem Types

URL Redirection to Untrusted Site ('Open Redirect') (CWE-601) CWE