CVE-2026-63472 Details
Description
Vendure is an open-source headless commerce platform. Prior to 3.7.0, ExternalAuthenticationService.createCustomerAndUser in packages/core/src/service/helpers/external-authentication/external-authentication.service.ts selects an existing customer user by emailAddress and attaches a newly presented ExternalAuthenticationMethod without requiring verified to be true. In deployments with a custom external AuthenticationStrategy that forwards an email whose ownership the provider has not verified, an attacker can authenticate with a victim's email and bind the attacker's external identity to the victim's existing account. This can expose orders, addresses, and personal information and permit account changes or orders as the victim. Native-only email and password deployments and external strategies that always require provider-verified email ownership are unaffected, and new-account creation for an unused email remains permitted. This issue is fixed in version 3.7.0.
A vulnerability in Vendure's external authentication process can lead to account takeover. This issue affects versions prior to 3.7.0. The problem arises in the ExternalAuthenticationService.createCustomerAndUser method, where an external authentication method is linked to an existing customer account based solely on email address, without requiring email verification. In cases where a custom authentication strategy is used that does not verify email ownership, an attacker can authenticate using a victim's email and bind their external identity to the victim's account. This can result in unauthorized access to the victim's orders, addresses, and personal information, as well as the ability to make account changes or place orders on their behalf.
Upgrade to Vendure version 3.7.0 or later. After upgrading, ensure that any custom external authentication strategies verify email ownership before linking to existing accounts.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 17, 2026CISA-ADP
Assessed Sep 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/vendurehq/vendure/security/advisories/GHSA-6j36-r6pr-59x4 | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/vendurehq/vendure/commit/3bb04718ea4f9395fda731bd2a4bcfc3afb0a485 | [email protected] | Source CodeVendor |
| https://github.com/vendurehq/vendure/releases/tag/v3.7.0 | [email protected] | Release NotesVendor |
| https://github.com/vendurehq/vendure/security/advisories/GHSA-6j36-r6pr-59x4 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Vendure | < 3.7.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 17, 2026 | CVE Modified | CISA-ADP |
| Sep 17, 2026 | New CVE Received | [email protected] |