CVE-2026-48012: Shopware Core and Platform Open Redirect Vulnerability
Summary
CVE-2026-48012: Shopware SSO referer trust leading to an arbitrary redirect target. Affects shopware/core versions >= 6.7.3.0, < 6.7.10.1. Fixed in 6.7.10.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Shopware is a popular open-source e-commerce platform that provides a comprehensive solution for online retailers. It offers features such as product management, customer management, and various integrations to enhance the shopping experience. The platform is built on a modular architecture, allowing developers to extend its functionality. However, a vulnerability has been identified in its Single Sign-On (SSO) implementation, specifically in the public SSO entry point, which can lead to security risks if not addressed.
Vulnerability Detail
The vulnerability arises from an open redirect in Shopware's public SSO entry point at GET /api/oauth/sso/auth. When accessed without the expected SSO session state, the application incorrectly uses the request's Referer header as the redirect destination. This behavior allows an unauthenticated attacker to manipulate the Referer header to redirect users to arbitrary URLs, including malicious sites. The lack of restrictions on the redirect target can lead to phishing attacks and brand impersonation, as the endpoint appears to originate from a trusted application.
How To Fix
Minimum fixed version
6.7.10.1
This is the first release that contains the fix.
composer require shopware/core:6.7.10.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the Referer header for redirect logic. Instead, implement a fixed error response or redirect to a predetermined internal page when the expected SSO state is missing. This can be done by modifying the redirect logic in the application code to ignore the Referer header.
Conclusion
The open redirect vulnerability in Shopware's SSO implementation poses a significant risk to users and the integrity of the application. It is crucial to update to the latest patched versions to mitigate these risks. Additionally, implementing secure coding practices and using tools like Vulert can help monitor and prevent future vulnerabilities.
See every vulnerability recorded for shopware/core →
FAQ
The vulnerability is an open redirect that allows attackers to redirect users to arbitrary URLs by manipulating the Referer header.
If you are using Shopware versions between 6.7.3.0 and 6.7.10.0, your instance is vulnerable. You can check your version in the composer.lock file.
The vulnerability can lead to phishing attacks, brand impersonation, and exploitation of user trust, as attackers can redirect users to malicious sites.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software without requiring access to the code. You can check if your application is affected using the Vulert playground.
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for shopware/core.
