Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-63472— Vendure: External-authentication account takeover: external login linked to a pre-existing account by email without verification

Quick assessment

Affected
vendurehq vendure
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Vendure 是一个开源的无头（headless）电商（commerce）平台。在 3.7.0 之前的版本中，位于 文件中的 方法会根据 查找已存在的客户用户，并在未要求 字段为 的情况下，将新提交的 绑定到该用户账户。 在采用自定义外部认证策略（ ）的部署环境中，如果该策略会转发邮件地址（即使服务提供商尚未验证该邮箱的所有权），攻击者可以使用受害者的邮箱进行认证，并将自己的外部身份与受害者现有的账户绑定。这可能导致泄露订单、收货地址及个人隐私信息，并允许攻击者以受害者的身份修改账户信息或下单购物。 仅使用原生邮

CVSS 9.1 · Critical
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-63472

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Vendure: External-authentication account takeover: external login linked to a pre-existing account by email without verification
Source: CVE Program / CVE List V5
Vulnerability Description
Vendure is an open-source headless commerce platform. Prior to 3.7.0, ExternalAuthenticationService.createCustomerAndUser in packages/core/src/service/helpers/external-authentication/external-authentication.service.ts selects an existing customer user by emailAddress and attaches a newly presented ExternalAuthenticationMethod without requiring verified to be true. In deployments with a custom external AuthenticationStrategy that forwards an email whose ownership the provider has not verified, an attacker can authenticate with a victim's email and bind the attacker's external identity to the victim's existing account. This can expose orders, addresses, and personal information and permit account changes or orders as the victim. Native-only email and password deployments and external strategies that always require provider-verified email ownership are unaffected, and new-account creation for an unused email remains permitted. This issue is fixed in version 3.7.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
vendurehq vendure < 3.7.0 -

II. Public POCs for CVE-2026-63472

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-63472

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-63472 (1)

Vendor Advisories for CVE-2026-63472 (1)

Vendor Pages for CVE-2026-63472 (1)

Same Patch Batch · vendurehq · 2026-09-17 · 4 CVEs total

CVE-2026-63459 8.7 HIGH Vendure: Stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity
CVE-2026-63460 7.5 HIGH Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends
CVE-2026-63461 5.3 MEDIUM Vendure: Shop API list queries can return non-public entities when filterOperator is OR

IV. Related Vulnerabilities

Same product: vendure
Same vendor: vendurehq
Same weakness: CWE-287

V. Comments for CVE-2026-63472

No comments yet

Leave a comment