CVE-2026-63472 (GCVE-0-2026-63472)

Vulnerability from cvelistv5 – Published: 2026-09-17 14:40 – Updated: 2026-09-17 15:21

Title

Vendure: External-authentication account takeover: external login linked to a pre-existing account by email without verification

Summary

Vendure is an open-source headless commerce platform. Prior to 3.7.0, ExternalAuthenticationService.createCustomerAndUser in packages/core/src/service/helpers/external-authentication/external-authentication.service.ts selects an existing customer user by emailAddress and attaches a newly presented ExternalAuthenticationMethod without requiring verified to be true. In deployments with a custom external AuthenticationStrategy that forwards an email whose ownership the provider has not verified, an attacker can authenticate with a victim's email and bind the attacker's external identity to the victim's existing account. This can expose orders, addresses, and personal information and permit account changes or orders as the victim. Native-only email and password deployments and external strategies that always require provider-verified email ownership are unaffected, and new-account creation for an unused email remains permitted. This issue is fixed in version 3.7.0.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-17 15:20 UTC

CWE

CWE-287 - Improper Authentication

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/vendurehq/vendure/security/adv…	x_refsource_CONFIRM
https://github.com/vendurehq/vendure/commit/3bb04…	x_refsource_MISC
https://github.com/vendurehq/vendure/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
vendurehq	vendure	Affected: < 3.7.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63472",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-17T15:20:50.486756Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-17T15:21:11.192Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/vendurehq/vendure/security/advisories/GHSA-6j36-r6pr-59x4"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vendure",
          "vendor": "vendurehq",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.7.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vendure is an open-source headless commerce platform. Prior to 3.7.0, ExternalAuthenticationService.createCustomerAndUser in packages/core/src/service/helpers/external-authentication/external-authentication.service.ts selects an existing customer user by emailAddress and attaches a newly presented ExternalAuthenticationMethod without requiring verified to be true. In deployments with a custom external AuthenticationStrategy that forwards an email whose ownership the provider has not verified, an attacker can authenticate with a victim\u0027s email and bind the attacker\u0027s external identity to the victim\u0027s existing account. This can expose orders, addresses, and personal information and permit account changes or orders as the victim. Native-only email and password deployments and external strategies that always require provider-verified email ownership are unaffected, and new-account creation for an unused email remains permitted. This issue is fixed in version 3.7.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-17T14:40:31.353Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vendurehq/vendure/security/advisories/GHSA-6j36-r6pr-59x4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vendurehq/vendure/security/advisories/GHSA-6j36-r6pr-59x4"
        },
        {
          "name": "https://github.com/vendurehq/vendure/commit/3bb04718ea4f9395fda731bd2a4bcfc3afb0a485",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vendurehq/vendure/commit/3bb04718ea4f9395fda731bd2a4bcfc3afb0a485"
        },
        {
          "name": "https://github.com/vendurehq/vendure/releases/tag/v3.7.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vendurehq/vendure/releases/tag/v3.7.0"
        }
      ],
      "source": {
        "advisory": "GHSA-6j36-r6pr-59x4",
        "discovery": "UNKNOWN"
      },
      "title": "Vendure: External-authentication account takeover: external login linked to a pre-existing account by email without verification"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63472",
    "datePublished": "2026-09-17T14:40:31.353Z",
    "dateReserved": "2026-07-16T21:37:45.769Z",
    "dateUpdated": "2026-09-17T15:21:11.192Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-63472\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-09-17T15:16:49.743\",\"lastModified\":\"2026-09-17T21:16:02.560\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Vendure is an open-source headless commerce platform. Prior to 3.7.0, ExternalAuthenticationService.createCustomerAndUser in packages/core/src/service/helpers/external-authentication/external-authentication.service.ts selects an existing customer user by emailAddress and attaches a newly presented ExternalAuthenticationMethod without requiring verified to be true. In deployments with a custom external AuthenticationStrategy that forwards an email whose ownership the provider has not verified, an attacker can authenticate with a victim\u0027s email and bind the attacker\u0027s external identity to the victim\u0027s existing account. This can expose orders, addresses, and personal information and permit account changes or orders as the victim. Native-only email and password deployments and external strategies that always require provider-verified email ownership are unaffected, and new-account creation for an unused email remains permitted. This issue is fixed in version 3.7.0.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"vendurehq\",\"product\":\"vendure\",\"versions\":[{\"version\":\"\u003c 3.7.0\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-17T15:20:50.486756Z\",\"id\":\"CVE-2026-63472\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-287\"}]}],\"references\":[{\"url\":\"https://github.com/vendurehq/vendure/commit/3bb04718ea4f9395fda731bd2a4bcfc3afb0a485\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/vendurehq/vendure/releases/tag/v3.7.0\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/vendurehq/vendure/security/advisories/GHSA-6j36-r6pr-59x4\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/vendurehq/vendure/security/advisories/GHSA-6j36-r6pr-59x4\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"Vendure: External-authentication account takeover: external login linked to a pre-existing account by email without verification\", \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-287\", \"lang\": \"en\", \"description\": \"CWE-287: Improper Authentication\", \"type\": \"CWE\"}]}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"NONE\", \"baseScore\": 9.1, \"baseSeverity\": \"CRITICAL\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\", \"version\": \"3.1\"}}], \"references\": [{\"name\": \"https://github.com/vendurehq/vendure/security/advisories/GHSA-6j36-r6pr-59x4\", \"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://github.com/vendurehq/vendure/security/advisories/GHSA-6j36-r6pr-59x4\"}, {\"name\": \"https://github.com/vendurehq/vendure/commit/3bb04718ea4f9395fda731bd2a4bcfc3afb0a485\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/vendurehq/vendure/commit/3bb04718ea4f9395fda731bd2a4bcfc3afb0a485\"}, {\"name\": \"https://github.com/vendurehq/vendure/releases/tag/v3.7.0\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/vendurehq/vendure/releases/tag/v3.7.0\"}], \"affected\": [{\"vendor\": \"vendurehq\", \"product\": \"vendure\", \"versions\": [{\"version\": \"\u003c 3.7.0\", \"status\": \"affected\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-09-17T14:40:31.353Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Vendure is an open-source headless commerce platform. Prior to 3.7.0, ExternalAuthenticationService.createCustomerAndUser in packages/core/src/service/helpers/external-authentication/external-authentication.service.ts selects an existing customer user by emailAddress and attaches a newly presented ExternalAuthenticationMethod without requiring verified to be true. In deployments with a custom external AuthenticationStrategy that forwards an email whose ownership the provider has not verified, an attacker can authenticate with a victim\u0027s email and bind the attacker\u0027s external identity to the victim\u0027s existing account. This can expose orders, addresses, and personal information and permit account changes or orders as the victim. Native-only email and password deployments and external strategies that always require provider-verified email ownership are unaffected, and new-account creation for an unused email remains permitted. This issue is fixed in version 3.7.0.\"}], \"source\": {\"advisory\": \"GHSA-6j36-r6pr-59x4\", \"discovery\": \"UNKNOWN\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-63472\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-17T15:20:50.486756Z\"}}}], \"references\": [{\"url\": \"https://github.com/vendurehq/vendure/security/advisories/GHSA-6j36-r6pr-59x4\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-17T15:21:03.123Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-63472\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"GitHub_M\", \"dateReserved\": \"2026-07-16T21:37:45.769Z\", \"datePublished\": \"2026-09-17T14:40:31.353Z\", \"dateUpdated\": \"2026-09-17T15:21:11.192Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-63472

Vulnerability from fkie_nvd - Published: 2026-09-17 15:16 - Updated: 2026-09-17 21:16

Severity

9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/vendurehq/vendure/commit/3bb04718ea4f9395fda731bd2a4bcfc3afb0a485
	security-advisories@github.com	https://github.com/vendurehq/vendure/releases/tag/v3.7.0
	security-advisories@github.com	https://github.com/vendurehq/vendure/security/advisories/GHSA-6j36-r6pr-59x4
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/vendurehq/vendure/security/advisories/GHSA-6j36-r6pr-59x4

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "vendure",
          "vendor": "vendurehq",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.7.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vendure is an open-source headless commerce platform. Prior to 3.7.0, ExternalAuthenticationService.createCustomerAndUser in packages/core/src/service/helpers/external-authentication/external-authentication.service.ts selects an existing customer user by emailAddress and attaches a newly presented ExternalAuthenticationMethod without requiring verified to be true. In deployments with a custom external AuthenticationStrategy that forwards an email whose ownership the provider has not verified, an attacker can authenticate with a victim\u0027s email and bind the attacker\u0027s external identity to the victim\u0027s existing account. This can expose orders, addresses, and personal information and permit account changes or orders as the victim. Native-only email and password deployments and external strategies that always require provider-verified email ownership are unaffected, and new-account creation for an unused email remains permitted. This issue is fixed in version 3.7.0."
    }
  ],
  "id": "CVE-2026-63472",
  "lastModified": "2026-09-17T21:16:02.560",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-63472",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-17T15:20:50.486756Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-17T15:16:49.743",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/vendurehq/vendure/commit/3bb04718ea4f9395fda731bd2a4bcfc3afb0a485"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/vendurehq/vendure/releases/tag/v3.7.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/vendurehq/vendure/security/advisories/GHSA-6j36-r6pr-59x4"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/vendurehq/vendure/security/advisories/GHSA-6j36-r6pr-59x4"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-6J36-R6PR-59X4

Vulnerability from github – Published: 2026-09-17 14:50 – Updated: 2026-09-17 14:50

Summary

Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification

Details

External-authentication account takeover: external login linked to a pre-existing account by email without requiring verification

Package: @vendure/core (vendure-ecommerce/vendure, latest master) ·

[!IMPORTANT] This vulnerability only affects deployments that use external / social authentication (an AuthenticationStrategy other than the built-in native email/password strategy) where that strategy can return an email address the external provider has not verified the user owns.

You are affected if all of these are true: - Your store configures one or more external AuthenticationStrategy implementations (custom OAuth / social login / SSO), and - At least one forwards an emailAddress to ExternalAuthenticationService without guaranteeing the provider verified ownership of it (e.g. it doesn't check the provider's email_verified claim, or leaves verified unset/false), and - Customer accounts exist that share an email address with those external identities.

You are NOT affected if: - You use only the built-in native (email/password) authentication with no external strategies, or - Every external strategy you use only ever returns provider-verified emails (and sets verified: true).

Remediation: Upgrade to 3.7.0. After upgrading, an external login is only linked to a pre-existing account when the email is verified; a custom AuthenticationStrategy must set verified: true only for emails the provider has actually verified.

Summary

ExternalAuthenticationService.createCustomerAndUser() links a newly-presented external (OAuth/social) authentication method to a pre-existing User account selected purely by email-address match, and it does so without requiring config.verified === true. If any configured AuthenticationStrategy forwards an email that was not proven to belong to the external identity (the classic email_verified omission — common with custom OAuth providers, or providers/strategies that don't validate email ownership), an attacker can register at that provider using a victim's email address, authenticate, and have their external identity bound to the victim's existing Vendure account — resulting in account takeover.

Vulnerable code

packages/core/src/service/helpers/external-authentication/external-authentication.service.ts — createCustomerAndUser:

const existingUser = await this.findExistingCustomerUserByEmailAddress(ctx, config.emailAddress);
if (existingUser) {
    user = existingUser;                 // <-- links to the EXISTING account, by email alone
} else {
    user = new User({ identifier: config.emailAddress, verified: config.verified || false, ... });
}
const authMethod = await this.connection.getRepository(ctx, ExternalAuthenticationMethod).save(
    new ExternalAuthenticationMethod({ externalIdentifier: config.externalIdentifier, strategy: config.strategy }),
);
user.authenticationMethods = [...(user.authenticationMethods || []), authMethod];   // <-- external login attached
await this.connection.getRepository(ctx, User).save(user);

config.verified is used only to set User.verified and to write a CUSTOMER_VERIFIED history entry (later in the method) — it is never used to gate whether the external method may be attached to an existing account. So an unverified external email links to the victim's account just the same.

Impact

Account takeover of any customer whose email address an attacker can present (unverified) via an external auth provider — read/modify the victim's orders, addresses, and PII, and place orders as them. The blast radius depends on the deployed AuthenticationStrategy(ies): strategies that don't strictly require a provider-verified email (or providers that don't guarantee email ownership) are directly exploitable.

Reproduction (conceptual)

Victim has a native Vendure customer account victim@example.com.
Attacker authenticates through an external provider configured on the store, presenting emailAddress = victim@example.com with verified unset/false (depending on the strategy/provider).
createCustomerAndUser finds the victim's existing User by email and attaches the attacker's ExternalAuthenticationMethod.
Attacker logs in via that external method → authenticated as the victim.

Suggested fix

Refuse to bind an external authentication method to a pre-existing account unless the email is provably verified, and prefer explicit, authenticated account-linking:

if (existingUser) {
    if (!config.verified) {
        // Do not silently link an unverified external identity to an existing account.
        throw new EmailAddressConflictError(); // or require the user to link while logged in
    }
    user = existingUser;
}

Document clearly that an AuthenticationStrategy MUST only set verified: true for provider-verified emails, and that linking to existing accounts requires it.

Severity

9.1 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@vendure/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.7.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-63472"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-17T14:50:22Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "# External-authentication account takeover: external login linked to a pre-existing account by email without requiring verification\n\n**Package:** @vendure/core (vendure-ecommerce/vendure, latest master) \u00b7 \n\n\u003e [!IMPORTANT]\n\u003e This vulnerability **only affects deployments that use external / social authentication**\n(an `AuthenticationStrategy` other than the built-in native email/password strategy) where\nthat strategy can return an email address the external provider has **not verified** the\nuser owns.\n\n**You are affected if all of these are true:**\n- Your store configures one or more external `AuthenticationStrategy` implementations\n  (custom OAuth / social login / SSO), **and**\n- At least one forwards an `emailAddress` to `ExternalAuthenticationService` without\n  guaranteeing the provider verified ownership of it (e.g. it doesn\u0027t check the provider\u0027s\n  `email_verified` claim, or leaves `verified` unset/false), **and**\n- Customer accounts exist that share an email address with those external identities.\n\n**You are NOT affected if:**\n- You use only the built-in native (email/password) authentication with no external strategies, **or**\n- Every external strategy you use only ever returns provider-verified emails (and sets `verified: true`).\n\n**Remediation:** Upgrade to **3.7.0**. After upgrading, an external login is only linked to a\npre-existing account when the email is verified; a custom `AuthenticationStrategy` must set\n`verified: true` only for emails the provider has actually verified.\n\n## Summary\n`ExternalAuthenticationService.createCustomerAndUser()` links a newly-presented external (OAuth/social) authentication method to a **pre-existing User account selected purely by email-address match**, and it does so **without requiring `config.verified === true`**. If any configured `AuthenticationStrategy` forwards an email that was not proven to belong to the external identity (the classic `email_verified` omission \u2014 common with custom OAuth providers, or providers/strategies that don\u0027t validate email ownership), an attacker can register at that provider using a victim\u0027s email address, authenticate, and have their external identity bound to the victim\u0027s existing Vendure account \u2014 resulting in account takeover.\n\n## Vulnerable code\n`packages/core/src/service/helpers/external-authentication/external-authentication.service.ts` \u2014 `createCustomerAndUser`:\n```ts\nconst existingUser = await this.findExistingCustomerUserByEmailAddress(ctx, config.emailAddress);\nif (existingUser) {\n    user = existingUser;                 // \u003c-- links to the EXISTING account, by email alone\n} else {\n    user = new User({ identifier: config.emailAddress, verified: config.verified || false, ... });\n}\nconst authMethod = await this.connection.getRepository(ctx, ExternalAuthenticationMethod).save(\n    new ExternalAuthenticationMethod({ externalIdentifier: config.externalIdentifier, strategy: config.strategy }),\n);\nuser.authenticationMethods = [...(user.authenticationMethods || []), authMethod];   // \u003c-- external login attached\nawait this.connection.getRepository(ctx, User).save(user);\n```\n`config.verified` is used only to set `User.verified` and to write a `CUSTOMER_VERIFIED` history entry (later in the method) \u2014 it is **never** used to gate whether the external method may be attached to an existing account. So an unverified external email links to the victim\u0027s account just the same.\n\n## Impact\nAccount takeover of any customer whose email address an attacker can present (unverified) via an external auth provider \u2014 read/modify the victim\u0027s orders, addresses, and PII, and place orders as them. The blast radius depends on the deployed `AuthenticationStrategy`(ies): strategies that don\u0027t strictly require a provider-verified email (or providers that don\u0027t guarantee email ownership) are directly exploitable.\n\n## Reproduction (conceptual)\n1. Victim has a native Vendure customer account `victim@example.com`.\n2. Attacker authenticates through an external provider configured on the store, presenting `emailAddress = victim@example.com` with `verified` unset/false (depending on the strategy/provider).\n3. `createCustomerAndUser` finds the victim\u0027s existing User by email and attaches the attacker\u0027s `ExternalAuthenticationMethod`.\n4. Attacker logs in via that external method \u2192 authenticated as the victim.\n\n## Suggested fix\nRefuse to bind an external authentication method to a **pre-existing** account unless the email is provably verified, and prefer explicit, authenticated account-linking:\n```ts\nif (existingUser) {\n    if (!config.verified) {\n        // Do not silently link an unverified external identity to an existing account.\n        throw new EmailAddressConflictError(); // or require the user to link while logged in\n    }\n    user = existingUser;\n}\n```\nDocument clearly that an `AuthenticationStrategy` MUST only set `verified: true` for provider-verified emails, and that linking to existing accounts requires it.",
  "id": "GHSA-6j36-r6pr-59x4",
  "modified": "2026-09-17T14:50:22Z",
  "published": "2026-09-17T14:50:22Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/vendurehq/vendure/security/advisories/GHSA-6j36-r6pr-59x4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vendurehq/vendure/commit/3bb04718ea4f9395fda731bd2a4bcfc3afb0a485"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vendurehq/vendure"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vendurehq/vendure/releases/tag/v3.7.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-63472 (GCVE-0-2026-63472)

FKIE_CVE-2026-63472

GHSA-6J36-R6PR-59X4

External-authentication account takeover: external login linked to a pre-existing account by email without requiring verification

Summary

Vulnerable code

Impact

Reproduction (conceptual)

Suggested fix

Tags

Sightings

Nomenclature

Related by attack behaviour