CVE-2026-63472
CriticalCVSS 9.1Summary
In Vendure, the createCustomerAndUser function in external authentication matches an existing customer by email address and attaches a new external authentication method without requiring verification. An attacker can use an unverified email to hijack the victim's account.
Risk Assessment
Risk of account takeover, potentially exposing personal data, orders, and allowing changes or purchases as the victim.
Recommendation
Update Vendure to version 3.7.0 or later to enforce email verification before linking identities to existing accounts.
Other vulnerabilities in Vendure
See all- CVE-2026-63461Medium
In Vendure prior to 3.6.5, public Shop API products, collections, and facets queries combine mandatory visibility guards with caller-supplied filters using the caller-controlled filterOperator. When filterOperator is OR, a predicate matching a hidden entity can bypass the Product.enabled, Collection.isPrivate, or Facet.isPrivate guard. An unauthenticated caller can therefore retrieve disabled products and private collections or facets.
- CVE-2026-63460High
Vendure prior to 3.6.5 allows an unauthenticated caller to supply a catastrophically backtracking regular expression pattern through StringOperators.regex in the public Shop GraphQL API. Deployments using better-sqlite3 and sqljs evaluate the pattern synchronously in the Node.js event loop, which can block request processing. The issue is fixed in version 3.6.5.
- CVE-2026-63459High
Vendure prior to 3.6.5 contains a stored XSS vulnerability in RichTextDescriptionCell, which assigns an administrator-controlled description to a live element's innerHTML and then reads textContent. Active resource markup can execute an event handler during the innerHTML assignment before textContent is read. A lower-privilege administrator can store such markup in descriptions rendered by the Products, Collections, Promotions, Payment Methods, or Shipping Methods lists, and script executes when another administrator views the affected row.
- CVE-2026-67347Medium
A vulnerability in Vendure (up to version 3.7.1) allows channel-scoped administrators to modify other tenants' data by bypassing channel isolation validation. The attack involves supplying global IDs of StockLocation or Asset entities from different channels.
Original NVD description (English source)
Vendure is an open-source headless commerce platform. Prior to 3.7.0, ExternalAuthenticationService.createCustomerAndUser in packages/core/src/service/helpers/external-authentication/external-authentication.service.ts selects an existing customer user by emailAddress and attaches a newly presented ExternalAuthenticationMethod without requiring verified to be true. In deployments with a custom external AuthenticationStrategy that forwards an email whose ownership the provider has not verified, an attacker can authenticate with a victim's email and bind the attacker's external identity to the victim's existing account. This can expose orders, addresses, and personal information and permit account changes or orders as the victim. Native-only email and password deployments and external strategies that always require provider-verified email ownership are unaffected, and new-account creation for an unused email remains permitted. This issue is fixed in version 3.7.0.