CVE-2026-63472 in Vendure
Summary
by MITRE • 09/17/2026
Vendure is an open-source headless commerce platform. Prior to 3.7.0, ExternalAuthenticationService.createCustomerAndUser in packages/core/src/service/helpers/external-authentication/external-authentication.service.ts selects an existing customer user by emailAddress and attaches a newly presented ExternalAuthenticationMethod without requiring verified to be true. In deployments with a custom external AuthenticationStrategy that forwards an email whose ownership the provider has not verified, an attacker can authenticate with a victim's email and bind the attacker's external identity to the victim's existing account. This can expose orders, addresses, and personal information and permit account changes or orders as the victim. Native-only email and password deployments and external strategies that always require provider-verified email ownership are unaffected, and new-account creation for an unused email remains permitted. This issue is fixed in version 3.7.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
Vendure is a widely adopted open-source headless commerce platform designed to facilitate e-commerce operations through API-driven interactions. A critical security flaw was identified within the external authentication logic prior to version 3.7.0, specifically residing in the ExternalAuthenticationService.createCustomerAndUser method located in packages/core/src/service/helpers/external-authentication/external-authentication.service.ts. This vulnerability stems from an insufficient verification of email ownership during the account linking process. When a user attempts to authenticate using an external identity provider, such as Google or Facebook, the system checks if a customer record already exists associated with the provided email address. If one is found, the service proceeds to attach the new ExternalAuthenticationMethod to that existing account without verifying whether the email address has been confirmed by the platform administrator or through native verification mechanisms.
The technical flaw allows for an Account Takeover scenario where an attacker can hijack a victim's account if they control an external identity provider linked to the same email address as the victim, but only under specific deployment conditions. This risk is particularly acute in deployments utilizing custom external AuthenticationStrategies that do not enforce strict validation of email ownership by the third-party provider. In such configurations, if the external authentication service forwards an email claim without a verified status flag from the identity provider, Vendure accepts this unverified assertion as sufficient proof of identity. Consequently, an attacker who has compromised or created an account on an external platform using the victim's email address can successfully authenticate and bind their external credentials to the victim's existing commerce account. This bypasses traditional security controls that rely solely on the existence of a user record rather than the proven ownership of the associated contact information.
The operational impact of this vulnerability is severe, as it grants an attacker full control over the compromised customer account. Once authenticated, the attacker gains access to sensitive personal data including order history, shipping addresses, and payment methods stored within the platform. Beyond privacy violations, this unauthorized access enables malicious actions such as placing fraudulent orders using saved payment details, modifying account settings, or exploiting any business logic that relies on user identity for authorization decisions. This undermines the integrity of the e-commerce system and can lead to significant financial loss and reputational damage for both the merchant operating Vendure and the affected customers. The vulnerability is classified under CWE-287: Improper Authentication because it fails to adequately verify the identity of a user during authentication, specifically by accepting unverified email claims as sufficient proof of ownership when linking external identities.
Mitigation strategies focus on ensuring that only verified email addresses are used for account linkage and strengthening the validation logic within custom authentication strategies. The primary remediation is upgrading Vendure to version 3.7.0 or later, where this logical flaw has been corrected by enforcing stricter checks before binding an ExternalAuthenticationMethod to an existing user record. For organizations unable to upgrade immediately due to compatibility constraints, a temporary workaround involves modifying the external AuthenticationStrategy implementation to explicitly check for a verified status from the identity provider and rejecting authentication attempts if that flag is absent or false. Additionally, administrators should review their custom strategies to ensure they do not forward unverified email claims. Deployments using native-only email and password authentication are unaffected by this specific vector since they rely on direct user input rather than third-party assertions. Similarly, external strategies configured to always require provider-verified email ownership remain secure against this particular attack path. New account creation for unused emails remains permitted as the vulnerability specifically targets existing accounts where an attacker can exploit the linking mechanism rather than creating a new identity from scratch.