CVE-2026-63472: Vendure Package Vulnerability Leading to External Authentication Account Takeover
Summary
CVE-2026-63472: External-authentication account takeover: external login linked to a pre-existing account by email without requiring verification Package: @vendure/core (vendure-ecommerce/vendure, latest master) · > [!IMPORTANT] > This... Affects @vendure/core versions < 3.7.0. Fixed in 3.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vendure is an open-source e-commerce framework designed for building scalable and customizable online stores. It provides a robust set of features, including support for various authentication strategies, allowing users to log in via email/password or external social accounts. However, a critical vulnerability has been identified in the external authentication mechanism, which can lead to account takeover if not properly managed.
Vulnerability Detail
The vulnerability arises from the way Vendure handles external authentication. Specifically, the 'ExternalAuthenticationService.createCustomerAndUser()' method links an external authentication method to an existing user account based solely on email address matching, without verifying that the email address is owned by the external identity. This flaw allows an attacker to register with a social provider using a victim's email address, authenticate through that provider, and gain unauthorized access to the victim's Vendure account. The ramifications include potential access to sensitive customer information, order manipulation, and identity theft.
How To Fix
Minimum fixed version
3.7.0
This is the first release that contains the fix.
npm install @vendure/core@3.7.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can modify the 'createCustomerAndUser' method to prevent linking unverified external identities to existing accounts. Implement the following code snippet:
if (existingUser) {
if (!config.verified) {
throw new EmailAddressConflictError(); // Prevent linking unverified email
}
user = existingUser;
}
Conclusion
The CVE-2026-63472 vulnerability in the Vendure package poses a significant risk to users employing external authentication methods. It is crucial to upgrade to version 3.7.0 or later to mitigate this risk and ensure that email verification is enforced when linking external accounts.
See every vulnerability recorded for @vendure/core →
FAQ
CVE-2026-63472 is a critical vulnerability in the Vendure package that allows external authentication account takeover due to improper email verification.
Deployments of Vendure that utilize external authentication strategies without verifying email ownership are at risk.
An attacker can gain unauthorized access to a victim's account, allowing them to read or modify sensitive information and place orders.
You can use the Vulert playground at Vulert Scanner to monitor and alert for open-source vulnerabilities in your application without requiring signup.
The CVSS score of this vulnerability is 9.1, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for @vendure/core.
