CVE-2026-48012: Shopware open redirect in SSO entry point via Referer header

CVE-2026-48012 · Severity: medium · CVSS 4.3 · Published 2026-07-23

Shopware, an open-source e-commerce platform, contains a security flaw in its Single Sign-On (SSO) login system. An attacker can create a malicious link that appears to be a legitimate part of the trusted store but instead redirects users to a fraudulent website or executes malicious scripts. This can be used in phishing campaigns to steal customer credentials or damage the brand's reputation by making the official site appear to host malicious content.

Technologies: shopware/core (Packagist), shopware/platform (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-48012 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48012 being exploited in the wild.
How severe is CVE-2026-48012?
Medium severity, with a CVSS score of 4.3, published 23 July 2026.
Which products and versions are affected?
shopware/core (Packagist) >= 6.7.3.0, < 6.7.10.1, ECOSYSTEM:introduced=6.7.3.0,fixed=6.7.10.1; shopware/platform (Packagist) >= 6.7.3.0, < 6.7.10.1, ECOSYSTEM:introduced=6.7.3.0,fixed=6.7.10.1.
Is there a fix for CVE-2026-48012?
Yes. shopware/core (Packagist): upgrade to 6.7.10.1 or later; shopware/platform (Packagist): upgrade to 6.7.10.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48012 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-48012?
Check whether you run shopware/core (Packagist) or shopware/platform (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • shopware/core (Packagist): upgrade to 6.7.10.1 or later
    composer require shopware/core:^6.7.10.1
  • shopware/platform (Packagist): upgrade to 6.7.10.1 or later
    composer require shopware/platform:^6.7.10.1

Technical details

An open redirect vulnerability exists in Shopware's public SSO entry point at `GET /api/oauth/sso/auth`. When the endpoint is accessed without a valid SSO session state, the application incorrectly falls back to using the 'Referer' header as the redirect destination. The application fails to validate this header, allowing absolute URLs, external domains, and dangerous URI schemes like 'javascript:'. An attacker can exploit this by crafting a request with a malicious Referer header; the server will then respond with a 302 redirect and an HTML body containing a meta refresh tag pointing to the attacker-controlled location. This can be used for phishing or potentially Cross-Site Scripting (XSS) depending on how the client handles the 'javascript:' scheme in the Location header and HTML body. The issue is resolved in version 6.7.10.1.

Affected products

  • Shopware shopware/core >= 6.7.3.0, < 6.7.10.1
  • Shopware shopware/platform >= 6.7.3.0, < 6.7.10.1

Identifiers

  • CVE-2026-48012
  • GHSA-4x3x-869w-xx3m

Timeline

  • 2026-05-19: patched: Security release v6.7.10.1 published.
  • 2026-07-23: disclosed: CVE-2026-48012 published to NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.