Adobe Commerce Open Source (Magento Open Source)

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (CVSS 9.0 - 10.0), Tier 1 range; on a Tier 2 product the same band pays $2,500 - $5,000 │ $5,000 - $10,000 │ $6,000 - $11,000 High (CVSS 7.0 - 8.9), Tier 1 range; on a Tier 2 product the same band pays $500 - $2,500 │ $1,000 - $5,000 │ $1,250 - $6,000 Medium (CVSS 4.0 - 6.9), Tier 1 range; on a Tier 2 product the same band pays $100 - $500 │ $200 - $1,000 │ $250 - $1,250 Low (CVSS 0.1 - 3.9), Tier 1 range; on a Tier 2 product the same band pays up to $100 │ $100 - $200 │ $125 - $250 Submit a vulnerability CVE history 60 Last 12 months 421 Lifetime Latest advisories Loading the feed Overview Adobe Commerce Open Source is the edition of Magento 2 that anyone can download and self-host: the OSL-3.0 PHP codebase at github.com/magento/magento2, running merchant storefronts, admin panels and checkout flows on servers the merchants operate themselves. It matters because the same code is the base of the proprietary Adobe Commerce and Commerce B2B editions Adobe sells, and because the software's job is to take payment and hold customer records, a defect an anonymous visitor can reach lands on every self-hosted installation at once, and installations get patched at whatever pace the merchant manages. Adobe pays cash for a report here, which is worth stating plainly because the platform is widely assumed to be points-only: the asset is eligible for bounty, the team offers bounties in USD, and Adobe's Trust Center states that it "offers monetary rewards for valid security vulnerabilities reported through our public bug bounty program". The published ladder runs $5,000 to $10,000 for a Critical down to $100 to $200 for a Low on the Tier 1 range, and Adobe does not publish which tier this asset sits in, on a Tier 2 product the same bands are $2,500 to $5,000 down to $100. Testing is permitted against your own local installation, and a Testing IP address has to be supplied before any payout is released. sorona.xyz adds 1.25× on top of whatever Adobe awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope The HackerOne asset row "Adobe Commerce, Commerce B2B and Commerce Open Source", marked eligible for bounty, with the test plan permitting testing against your own local installation. Commerce Open Source is the OSL-3.0 magento/magento2 codebase, and the two proprietary editions ride on the same row The storefront request path an anonymous visitor reaches: front-controller dispatch and URL rewrites, request and cookie handling, session management, and the catalogue, search and CMS surfaces served from it The admin panel and its access model: login, two-factor enrolment, form keys, the ACL and role system, and every admin controller and grid sitting behind them The REST, GraphQL and SOAP web APIs, along with the integration token and OAuth model that decides which resources a caller may read or write Account, cart, quote, checkout and order processing, including totals and price computation, cart-rule and coupon evaluation, and the payment and shipping integrations that ship in the box Rendering and serialization: the XML layout system, block and template evaluation, the framework's escaping helpers, and file, archive and image handling wherever attacker-controlled data crosses into them The framework underneath the modules: the ORM and database adapter, dependency injection and plugin interception, cache and session backends, cron, the message-queue consumers and the bin/magento CLI Installer, upgrade and static-content entry points the repository ships, including the media and static file handlers reachable under pub/ Out of scope Magento 1: the legacy asset is marked neither eligible for bounty nor eligible for submission, so a finding there cannot be filed here even for triage Third-party extensions and marketplace modules, which are not part of the shipped Commerce editions the asset row names Testing carried out against live merchant storefronts or Adobe-operated environments, when the test plan permits testing only against your own local installations Adobe's other products, which sit on other asset rows of the same HackerOne program rather than on this one Payment gates that apply across the Adobe program: identity verification before a payout is released, and the stated requirement to "provide your Testing IP address" in order to receive a monetary payout Whatever Adobe's own written exclusions cover: read the program's policy and scope page in full before assuming a bug class qualifies Most-valued findings Unauthenticated remote code execution against a default installation, which is the only shape that reliably reaches the $5,000 to $10,000 Critical band and the one that historically turns a Magento release into an ecosystem-wide compromise event SQL injection or PHP object injection reachable without credentials, since both convert directly into database access or code execution and neither needs a merchant to have misconfigured anything Admin authentication bypass or privilege escalation, where a low-privilege or unauthenticated actor reaches the admin panel and therefore the whole store's data and its deployed code Authorisation gaps in the REST and GraphQL APIs that return another customer's orders, addresses or payment metadata: high impact on a platform whose entire dataset is personal and financial Checkout and pricing logic flaws that let an order be placed at a price the merchant never set, or that expose card-handling metadata as it passes through the flow Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Test against your own local installation: the program's test plan states that "Researchers may perform their testing against their own local installations", which is what makes reproducing an e-commerce bug legal here at all Supply your Testing IP address — the program states that "In order to receive a monetary bug bounty payout (when applicable), you must provide your Testing IP address", so a report filed without one cannot be paid Identity verification is required before Adobe releases a payout; there is no submission fee Adobe does not publish which reward tier this asset sits in, so treat the Tier 1 range as the best case and the Tier 2 range as what you might actually be offered The legacy Magento 1 asset is neither eligible for a bounty nor eligible for submission, so a Magento 1 finding cannot be filed on this program at all Report to Adobe through HackerOne first, and read what the policy says about sharing a finding with anyone else before the report goes anywhere except to Adobe Disclosure Coordinated through HackerOne, on Adobe's clock. File with Adobe through HackerOne directly, and hold the detail until Adobe confirms a fix has shipped and you are clear to publish. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability