Shopware up to 6.6.10.15/6.7.8.1 authentication spoofing

Summaryinfo

A vulnerability was found in Shopware up to 6.6.10.15/6.7.8.1. It has been rated as critical. Impacted is an unknown function. Performing a manipulation results in authentication spoofing. This vulnerability was named CVE-2026-31889. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, was found in Shopware up to 6.6.10.15/6.7.8.1. This affects an unknown function. The manipulation with an unknown input leads to a authentication spoofing vulnerability. CWE is classifying the issue as CWE-290. This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Shopware is an open commerce platform. Prior to 6.6.10.15 and 6.7.8.1, a vulnerability in the Shopware app registration flow that could, under specific conditions, allow attackers to take over the communication channel between a shop and an app. The legacy app registration flow used HMAC‑based authentication without sufficiently binding a shop installation to its original domain. During re‑registration, the shop-url could be updated without proving control over the previously registered shop or domain. This made targeted hijacking of app communication feasible if an attacker possessed the relevant app‑side secret. By abusing app re‑registration, an attacker could redirect app traffic to an attacker‑controlled domain and potentially obtain API credentials intended for the legitimate shop. This vulnerability is fixed in 6.6.10.15 and 6.7.8.1.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-31889 since 03/09/2026. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available.

Upgrading to version 6.6.10.15 or 6.7.8.1 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• Shopware

Version

• 6.6.10.0
• 6.6.10.1
• 6.6.10.2
• 6.6.10.3
• 6.6.10.4
• 6.6.10.5
• 6.6.10.6
• 6.6.10.7
• 6.6.10.8
• 6.6.10.9
• 6.6.10.10
• 6.6.10.11
• 6.6.10.12
• 6.6.10.13
• 6.6.10.14
• 6.6.10.15
• 6.7.8.0
• 6.7.8.1

License

• commercial

Website

• Product: https://github.com/shopware/shopware/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion