https://vulnerability.circl.lu/sightings/feed 2026-10-11T00:32:09.837351+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/7c8e6ed5-7f74-4f80-9c6c-6fcf96eb699e/export 2026-10-11T00:32:09.844253+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "7c8e6ed5-7f74-4f80-9c6c-6fcf96eb699e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-6j36-r6pr-59x4", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/117287023853537355", "content": "wat\nhttps://github.com/vendurehq/vendure/security/advisories/GHSA-6j36-r6pr-59x4\n\n1 - Victim has a native Vendure customer account victim@example.com.2 - Attacker authenticates through an external provider configured on the store, presenting emailAddress = victim@example.com with verified unset/false (depending on the strategy/provider).3 - createCustomerAndUser finds the victim's existing User by email and attaches the attacker's ExternalAuthenticationMethod.4 - Attacker logs in via that external method \u2192 authenticated as the victim.", "creation_timestamp": "2026-09-17T15:12:37.626523Z"} 2026-09-17T15:12:37.626523+00:00