EUVD-2026-81668
GHSA-6j36-r6pr-59x4
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
AC:H because exploitation depends on a non-default unverified-email custom strategy and a pre-existing victim account (conditions outside attacker control); PR:N/UI:N as the attacker needs no store credentials; C:H/I:H for full account takeover, A:N.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
Vendure is an open-source headless commerce platform. Prior to 3.7.0, ExternalAuthenticationService.createCustomerAndUser in packages/core/src/service/helpers/external-authentication/external-authentication.service.ts selects an existing customer user by emailAddress and attaches a newly presented ExternalAuthenticationMethod without requiring verified to be true. In deployments with a custom external AuthenticationStrategy that forwards an email whose ownership the provider has not verified, an attacker can authenticate with a victim's email and bind the attacker's external identity to the victim's existing account. This can expose orders, addresses, and personal information and permit account changes or orders as the victim. Native-only email and password deployments and external strategies that always require provider-verified email ownership are unaffected, and new-account creation for an unused email remains permitted. This issue is fixed in version 3.7.0.
AnalysisAI
Account takeover in Vendure (@vendure/core) prior to 3.7.0 allows an attacker to bind their own external OAuth/social identity to a victim's pre-existing customer account by presenting the victim's email address through a custom AuthenticationStrategy that does not enforce provider-verified email ownership. A successful link exposes the victim's orders, addresses and personal information and permits account changes or order placement as the victim, and the flaw is remotely reachable without authentication per the reported vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, 9.1 vendor score). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitable ONLY when the store configures at least one custom external AuthenticationStrategy (OAuth/social/SSO) that forwards an emailAddress to ExternalAuthenticationService without guaranteeing the provider verified ownership (i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS of 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) presents this as a critical, remote, unauthenticated flaw, but the raw score materially overstates real-world risk because the vulnerability is heavily gated. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade @vendure/core to 3.7.0 or later (release https://github.com/vendurehq/vendure/releases/tag/v3.7.0, advisory https://github.com/vendurehq/vendure/security/advisories/GHSA-6j36-r6pr-59x4, fix commit https://github.com/vendurehq/vendure/commit/3bb04718ea4f9395fda731bd2a4bcfc3afb0a485); after upgrading, an external login is linked to a pre-existing account only when the email is verified, and unverified attempts are rejected with the new UNVERIFIED_EXTERNAL_EMAIL error. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Vendure (@vendure/core) deployment, confirm whether it is below 3.7.0, and determine which custom AuthenticationStrategy implementations or external OAuth/social providers are enabled; where social login is enabled, disable those strategies or restrict them to providers that assert a verified email, and require a fresh verification or re-authentication step before any external identity can be linked to a pre-existing account. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today