Executive brief
Vendure, a popular Node.js e-commerce platform, has a critical authentication flaw in its external login (OAuth/SSO) feature. If a store uses social login or custom OAuth without properly verifying email ownership, an attacker can register at the external provider using a victim's email address and automatically gain control of their existing Vendure account, allowing them to view and modify orders, addresses, payment info, and place fraudulent purchases.
Technical details
The vulnerability exists in ExternalAuthenticationService.createCustomerAndUser() in @vendure/core, which accepts external authentication claims (OAuth/SSO/custom strategies). When processing a new external login, the service queries for an existing User by email address alone; if found, it attaches the attacker's external authentication method to that existing account without verifying the email ownership claim (the config.verified flag is not checked as a precondition). An AuthenticationStrategy that forwards unverified emails—omitting the provider's email_verified claim or failing to set verified: true—allows account linkage without proof of email ownership. Preconditions: deployment must use at least one external AuthenticationStrategy that permits unverified emails, and victim accounts must exist with matching email addresses. The flaw permits unauthenticated network-level exploitation: an attacker registers at the external provider with a victim's email, triggers authentication, and gains full account access. Patch: upgrade to 3.7.0, which gates external-to-existing linkage on verified: true and requires AuthenticationStrategy implementations to strictly validate provider email verification.
Affected products
- Vendure @vendure/core < 3.7.0
Timeline
- 2026-07-01: disclosed: Initial advisory published by Vendure team
- 2026-09-17: patched: Version 3.7.0 released with fix requiring email verification before linking external auth to existing accounts