MarcosCamara01 Ecommerce Template Checkout Session Lookup route.ts stripe.checkout.sessions.retrieve session_id missing authentication

Summaryinfo

A vulnerability was found in MarcosCamara01 Ecommerce Template. It has been rated as problematic. This issue affects the function stripe.checkout.sessions.retrieve of the file src/app/api/stripe/checkout_sessions/route.ts of the component Checkout Session Lookup Handler. The manipulation of the argument session_id leads to missing authentication. This vulnerability is documented as CVE-2026-90896. The attack can be initiated remotely. There is not any exploit available. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability was found in MarcosCamara01 Ecommerce Template (version unknown) and classified as problematic. This issue affects the function stripe.checkout.sessions.retrieve of the file src/app/api/stripe/checkout_sessions/route.ts of the component Checkout Session Lookup Handler. The manipulation of the argument session_id with an unknown input leads to a missing authentication vulnerability. Using CWE to declare the problem leads to CWE-306. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. Impacted is confidentiality. The summary by CVE is:

Missing Authentication for Critical Function (CWE-306) in the checkout session lookup handler (src/app/api/stripe/checkout_sessions/route.ts), exposed at GET /api/stripe/checkout_sessions, in MarcosCamara01 Ecommerce Template before commit 91e273c allows a remote, unauthenticated attacker holding a valid Stripe Checkout Session id (cs_...) to retrieve the full session object, including the buyer's name, email, phone, billing address, amount paid and internal userId, because the GET handler calls stripe.checkout.sessions.retrieve() and returns the result without checking for an authenticated session or session ownership. Sibling endpoints such as POST /api/stripe/payment already enforced authentication via auth.api.getSession(); this endpoint had no access control whatsoever. The session_id is exposed in the buyer's own browser URL after payment (success_url = /result?session_id={CHECKOUT_SESSION_ID}), so it leaks through Referer headers, analytics tools, server access logs and shared-machine browser history, resulting in disclosure of the buyer's personal data to an unauthenticated actor.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-90896 since 09/14/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available.

Applying the patch 91e273c is able to eliminate this problem.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• E-Commerce Management Software

Vendor

• MarcosCamara01

Name

• Ecommerce Template

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion