Critical Alert: Magento 2.4.8-p5 Security Patch APSB26-73 Breaks Persistent Cart Checkout

Critical Alert: Magento 2.4.8-p5 Security Patch APSB26-73 Breaks Persistent Cart Checkout

A significant issue has been identified in Magento Open Source and Adobe Commerce versions 2.4.8-p5, specifically affecting stores that have applied the APSB26-73 security update. This patch, intended to bolster guest cart security, inadvertently creates a critical conflict with the core Magento_Persistent module, leading to complete checkout failure for a common user scenario.

The problem manifests when a customer, remembered by the persistent shopping cart cookie but not actively logged in, attempts to proceed through checkout. Instead of a seamless experience, shoppers are met with a "Could not find a cart with ID ''" error at the shipping step, effectively halting the purchase process. This bug directly impacts the functionality that the Persistent Shopping Cart module is designed to provide, making it a high-priority concern for merchants and developers alike.

The Conflict: Security Meets Persistence

The root cause lies in the new guest cart validation logic introduced by APSB26-73, specifically within the Magento\Quote\Model\GuestCart\GetGuestCart::checkIsGuestCart method. This new check strictly enforces that a cart addressed by a masked ID should not have an associated customer_id (i.e., it must truly be a guest cart).

public function checkIsGuestCart(int $customerId, string $maskedCartId): void
{
    if ($customerId !== 0) {
        throw new NoSuchEntityException(
            __("Could not find a cart with ID '%masked_cart_id'", ['masked_cart_id' => $maskedCartId])
        );
    }
}

However, the Magento_Persistent module operates differently. When a shopper is "remembered" but not logged in, it intentionally creates a masked ID for a cart that still retains its original customer_id. This cart is then routed through guest checkout endpoints, with the conversion to a true guest cart (nullifying customer_id) only occurring at the very end of the process, just before order submission, via Magento\Persistent\Model\Plugin\ConvertCustomerCartToGuest::beforeSubmit().

The new security check fires much earlier in the checkout flow—at crucial steps like saving shipping information, calculating totals, or saving payment information—before the persistent module's conversion logic has a chance to execute. This premature validation results in the NoSuchEntityException, breaking the checkout.

Affected Scenarios and Reproduction

The issue can be reproduced by:

1. Logging into the storefront with "Remember Me" checked.
2. Adding a product to the cart.
3. Ending the session (e.g., deleting PHPSESSID cookie) while keeping the persistent cookie.
4. Proceeding to checkout with the remembered cart.

The impact is significant: any store utilizing Persistent Shopping Cart and applying this security patch will experience broken checkout for a substantial portion of their customer base. Developers can directly reproduce the error with a simple code snippet:

$om->get(\Magento\Quote\Api\GuestCartRepositoryInterface::class)->get($maskedId);
// Magento\Framework\Exception\NoSuchEntityException:
//   Could not find a cart with ID ''
//   GuestCartRepository.php:60  GetGuestCart->checkIsGuestCart(, '')

Potential Solutions and Next Steps

While no official patch or community-provided solution was available in the provided discussion, the issue author proposed two logical approaches:

• Early Conversion by Magento_Persistent: The Magento_Persistent module could be modified to perform the guest conversion (clearing the customer_id) earlier in the process, specifically when it hands the cart to an unauthenticated shopper, ensuring customer_id is null before any guest endpoint is called.
• Refined GuestCart Validation: The GetGuestCart validation could be enhanced to permit carts when the request carries a valid persistent session belonging to the customer who owns the cart. This would maintain the security boundary while accommodating the persistent cart's intended behavior.

This critical bug highlights the complexities of integrating security updates with existing module functionalities in Magento 2. Merchants running on 2.4.8-p5 with Persistent Shopping Cart enabled should investigate this issue immediately and consider temporary workarounds or delaying the security patch application until an official fix is released. For developers, understanding this interaction is crucial for debugging and implementing robust solutions.