A critical authorization bypass vulnerability in Akilli Commerce E-Commerce Website allows unauthenticated attackers to hijack user sessions and compromise sensitive data.

The application is susceptible to an authorization bypass caused by improper handling of user-controlled keys. This flaw allows an unauthenticated attacker to manipulate session parameters to hijack active user sessions.

Successful exploitation allows an attacker to impersonate legitimate users, including administrators, leading to unauthorized access to customer databases, transaction history, and potentially financial information. With a CVSS score of 9.8, this vulnerability represents an extreme risk to business operations and data privacy, warranting immediate remediation.

Immediate Action: Upgrade the E-Commerce Website software to version 4.5.001 or later immediately.

Proactive Monitoring: Review web server access logs for anomalous session tokens or requests originating from unusual IP addresses.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block suspicious session manipulation patterns.

Public Exploit Available: Unknown

Given the critical severity of this authentication bypass, organizations must prioritize patching their E-Commerce installations. Failure to update the software exposes the organization to significant risk of data exfiltration and complete account takeover.