{"vulnerability": "ghsa-6j36-r6pr-59x4", "sightings": [{"uuid": "7c8e6ed5-7f74-4f80-9c6c-6fcf96eb699e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-6j36-r6pr-59x4", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/117287023853537355", "content": "wat\nhttps://github.com/vendurehq/vendure/security/advisories/GHSA-6j36-r6pr-59x4\n\n1 - Victim has a native Vendure customer account victim@example.com.2 - Attacker authenticates through an external provider configured on the store, presenting emailAddress = victim@example.com with verified unset/false (depending on the strategy/provider).3 - createCustomerAndUser finds the victim's existing User by email and attaches the attacker's ExternalAuthenticationMethod.4 - Attacker logs in via that external method \u2192 authenticated as the victim.", "creation_timestamp": "2026-09-17T15:12:37.626523Z"}]}