CVE-2026-48012 in Shopware
Summary
by MITRE • 07/23/2026
Shopware is an open commerce platform. Versions 6.7.3.0 through 6.7.10.0 have an open redirect in Shopware's public SSO entry point at `GET /api/oauth/sso/auth`. When the endpoint is reached without the expected SSO session state, the application falls back to the request's `Referer` header and uses that value as the redirect destination. In the validated behavior, the server does not restrict that fallback target to same-origin URLs, does not require a relative path, and does not reject dangerous schemes such as `javascript:`. As a result, an unauthenticated request can turn this endpoint into a reusable redirect primitive whose destination is fully controlled by attacker-supplied request metadata. The security problem is not limited to a harmless navigation mismatch. The endpoint sits under `/api/oauth/`, which gives the redirect a trustworthy application-controlled origin and makes it suitable for phishing chains, branded redirect abuse, and cases where client software automatically follows redirects issued by a trusted host. The attached evidence also shows that the response is not only an HTTP `302` with a user-controlled `Location` header. The HTML body contains a matching meta refresh tag and redirect link built from the same attacker-controlled value. In the validated proof, the endpoint redirects to `https://attacker.example/poc` when that URL is supplied through `Referer`, and it also reflects `javascript:alert(1)` into `Location` and the HTML redirect body without any scheme filtering. This report therefore stays conservative and claims an open redirect with arbitrary redirect targets, while noting that the lack of scheme restrictions makes the behavior materially worse than a same-scheme external redirect. Version 6.7.10.1 fixes the issue.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/23/2026
The vulnerability identified in Shopware versions 6.7.3.0 through 6.7.10.0 resides within the public SSO entry point at GET /api/oauth/sso/auth, representing a critical open redirect flaw that fundamentally undermines the platform's security posture. This issue manifests when the endpoint processes requests lacking the expected SSO session state, causing the application to fall back to the request's Referer header to determine the redirect destination. The technical implementation fails to enforce any restrictions on this fallback mechanism, allowing attacker-controlled values to dictate where users are redirected without proper validation or sanitization.
The operational impact of this vulnerability extends far beyond simple navigation manipulation, as demonstrated by the comprehensive attack surface it creates. The endpoint's location beneath /api/oauth/ provides an inherently trusted origin that makes the redirect appear legitimate to end users and client software, enabling sophisticated phishing campaigns and branded redirect abuse. Security researchers have validated that the vulnerable implementation accepts arbitrary redirect targets including dangerous schemes such as javascript: without any filtering mechanisms, transforming what should be a controlled authentication flow into a weaponized redirect primitive. The vulnerability manifests not only through HTTP 302 responses with user-controlled Location headers but also through HTML meta refresh tags and redirect links that incorporate identical attacker-supplied values, creating multiple vectors for exploitation.
This weakness directly maps to CWE-601 Open Redirect vulnerability classification, specifically manifesting as CWE-601.1 where the application redirects users to unvalidated external URLs without proper origin validation or scheme filtering. The ATT&CK framework categorizes this as a technique involving web application vulnerabilities (T1190) that enables social engineering attacks through trusted domains, potentially leading to credential theft, malware distribution, and other malicious activities. The lack of restrictions on same-origin requirements, relative paths, and dangerous schemes creates an environment where attackers can craft redirects to arbitrary destinations including malicious payloads, making this vulnerability particularly dangerous for enterprise environments that rely on Shopware's authentication infrastructure.
The security implications are further amplified by the fact that client software automatically follows redirects issued by trusted hosts, creating a false sense of security that attackers can exploit. This vulnerability essentially allows an unauthenticated attacker to create phishing chains that appear to originate from the legitimate Shopware application, potentially compromising user credentials and system integrity. The fix implemented in version 6.7.10.1 addresses these fundamental flaws by enforcing proper validation of redirect destinations, restricting redirection to same-origin URLs, and implementing comprehensive scheme filtering to prevent dangerous protocols like javascript: from being executed. This remediation aligns with industry best practices for preventing open redirect vulnerabilities and demonstrates the critical importance of input validation and origin checking in authentication endpoints.