Magento CVE-2026-71362 Account Takeover Detect

Detects CVE-2026-71362 in Adobe Commerce / Magento Open Source before the APSB26-92 August 2026 patch: failed customer editPost poisons customerformdata and mass-assigns id into the active session. Registers a throwaway account and attempts a benign identity switch. !/usr/bin/env python3 -- codin...

Magento CVE-2026-71362 Customer Account Takeover

Exploits CVE-2026-71362 APSB26-92: a failed customer account editPost leaves attacker-controlled customerformdata in session, and a later edit consumes mass-assigned id to rebind the session to another customer. !/usr/bin/env python3 -- coding: utf-8 -- """Magento CVE-2026-71362 customer session...