Shopware 6.7.x SSO /api/oauth/sso/auth Open Redirect via Referer Trust

Vulnerability Overview Shopware SSO referer trust leads to an arbitrary redirect destination vulnerability. This vulnerability exists in Shopware's public SSO endpoint . When the endpoint is accessed without an expected SSO session, the application falls back to the header from the request and uses its value as the redirect destination. In its verification logic, the server does not restrict the fallback target to same-domain URLs, does not require relative paths, and does not block dangerous schemes such as . Consequently, unauthenticated requests can turn this endpoint into a redirect point with a malicious target, where the destination is fully controlled by the Referer provided by the attacker. Affected Versions Affected Versions: - : >= 6.7.3.0 = 6.7.3.0 < 6.7.10.1 Fixed Versions: - : 6.7.10.1 - : 6.7.10.1 Remediation 1. Stop using Referer as a fallback redirect target: If the application cannot complete the SSO flow because the required session state is missing, it should return a fixed error response or redirect to a fixed internal page, rather than a page influenced by request headers. The header is not a reliable source of navigation intent and should not be treated as an authorization or routing signal for security-sensitive logic. 2. Derive the destination securely: If the product requires retaining the destination, the destination should be derived from a server-generated state value or a validated cookie. The code should reject non-HTTPS schemes, reject scheme-based targets like and , and reject absolute URLs that are not same-origin with the current Shopware instance. Regression testing should include the following test cases: - When no is present, returning a 302 to when an external HTTPS URL is provided as . - When is provided, returning a 302 to when a dangerous scheme is provided. POC Code Additional Information CVSS v3 base metrics: - Attack vector: Network - Attack complexity: Low - Privileges required: None - User interaction: Required - Scope: Unchanged - Confidentiality: Low - Integrity: Low - Availability: Low CVE ID: CVE-2025-4832 Credits: lalala5078 (Reporter) Impact: An unauthenticated attacker can cause a trusted Shopware endpoint to issue redirects to arbitrary targets via the header. In the worst case, this enables standard open redirect attacks for phishing, impersonation, and redirection through legitimate websites. Since the redirect is issued from , the resulting URLs may appear more credible than generic site redirects and are more likely to be accepted by users or client applications to participate in the authentication flow. Note on submission channel: This issue was initially submitted via Shopware's official security report form. The form backend returned HTTP 400 for normal submissions and explicitly rejected and file types when attachments were included. Since the official form was not functional for me, I submitted this issue privately through GitHub's vulnerability reporting process.

Goal Reached Thanks to every supporter — we hit 100%!

Shopware 6.7.x SSO /api/oauth/sso/auth Open Redirect via Referer Trust

More from this source