https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 06:55:40 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-63472 <p>Vendure is an open-source headless commerce platform. Prior to 3.7.0, ExternalAuthenticationService.createCustomerAndUser in packages/core/src/service/helpers/external-authentication/external-authentication.service.ts selects an existing customer user by emailAddress and attaches a newly presented ExternalAuthenticationMethod without requiring verified to be true. In deployments with a custom external AuthenticationStrategy that forwards an email whose ownership the provider has not verified, an attacker can authenticate with a victim&#39;s email and bind the attacker&#39;s external identity to the victim&#39;s existing account. This can expose orders, addresses, and personal information and permit account changes or orders as the victim. Native-only email and password deployments and external strategies that always require provider-verified email ownership are unaffected, and new-account creation for an unused email remains permitted. This issue is fixed in version 3.7.0.</p> <p>Vendure is an open-source headless commerce platform. Prior to 3.7.0, ExternalAuthenticationService.createCustomerAndUser in packages/core/src/service/helpers/external-authentication/external-authentication.service.ts selects an existing customer user by emailAddress and attaches a newly presented ExternalAuthenticationMethod without requiring verified to be true. In deployments with a custom external AuthenticationStrategy that forwards an email whose ownership the provider has not verified, an attacker can authenticate with a victim&#39;s email and bind the attacker&#39;s external identity to the victim&#39;s existing account. This can expose orders, addresses, and personal information and permit account changes or orders as the victim. Native-only email and password deployments and external strategies that always require provider-verified email ownership are unaffected, and new-account creation for an unused email remains permitted. This issue is fixed in version 3.7.0.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-63472 https://vulnerability.circl.lu/vuln/ghsa-6j36-r6pr-59x4 <p><strong>Affected:</strong> npm: @vendure/core</p> <p># External-authentication account takeover: external login linked to a pre-existing account by email without requiring verification</p> <p>**Package:** @vendure/core (vendure-ecommerce/vendure, latest master) ·</p> <p>&gt; [!IMPORTANT] &gt; This vulnerability **only affects deployments that use external / social authentication** (an `AuthenticationStrategy` other than the built-in native email/password strategy) where that strategy can return an email address the external provider has **not verified** the user owns.</p> <p>**You are affected if all of these are true:** - Your store configures one or more external `AuthenticationStrategy` implementations (custom OAuth / social login / SSO), **and** - At least one forwards an `emailAddress` to `ExternalAuthenticationService` without guaranteeing the provider verified ownership of it (e.g. it doesn&#39;t check the provider&#39;s `email_verified` claim, or leaves `verified` unset/false), **and** - Customer accounts exist that share an email address with those external identities.</p> <p>**You are NOT affected if:** - You use only the built-in native (email/password) authentication with no external strategies, **or** - Every external strategy you use only ever returns provider-verified emails (and sets `verified: true`).</p> <p>**Remediation:** Upgrade to **3.7.0**. After upgrading, an external login is only linked to a pre-existing account when the email is verified; a custom `AuthenticationStrategy` must set `verified: true` only for emails the provider has actual…</p> <p><strong>Affected:</strong> npm: @vendure/core</p> <p># External-authentication account takeover: external login linked to a pre-existing account by email without requiring verification</p> <p>**Package:** @vendure/core (vendure-ecommerce/vendure, latest master) ·</p> <p>&gt; [!IMPORTANT] &gt; This vulnerability **only affects deployments that use external / social authentication** (an `AuthenticationStrategy` other than the built-in native email/password strategy) where that strategy can return an email address the external provider has **not verified** the user owns.</p> <p>**You are affected if all of these are true:** - Your store configures one or more external `AuthenticationStrategy` implementations (custom OAuth / social login / SSO), **and** - At least one forwards an `emailAddress` to `ExternalAuthenticationService` without guaranteeing the provider verified ownership of it (e.g. it doesn&#39;t check the provider&#39;s `email_verified` claim, or leaves `verified` unset/false), **and** - Customer accounts exist that share an email address with those external identities.</p> <p>**You are NOT affected if:** - You use only the built-in native (email/password) authentication with no external strategies, **or** - Every external strategy you use only ever returns provider-verified emails (and sets `verified: true`).</p> <p>**Remediation:** Upgrade to **3.7.0**. After upgrading, an external login is only linked to a pre-existing account when the email is verified; a custom `AuthenticationStrategy` must set `verified: true` only for emails the provider has actual…</p> https://vulnerability.circl.lu/vuln/ghsa-6j36-r6pr-59x4