CVE-2026-63472: Vendure account takeover in external authentication

CVE-2026-63472 · Severity: critical · CVSS 9.1 · Published 2026-09-17

Vendure, a popular Node.js e-commerce platform, has a critical authentication flaw in its external login (OAuth/SSO) feature. If a store uses social login or custom OAuth without properly verifying email ownership, an attacker can register at the external provider using a victim's email address and automatically gain control of their existing Vendure account, allowing them to view and modify orders, addresses, payment info, and place fraudulent purchases.

Technologies: @vendure/core (npm). Vendors: npm.

Quick answers

Is CVE-2026-63472 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-63472 being exploited in the wild.
How severe is CVE-2026-63472?
Critical severity, with a CVSS score of 9.1, published 17 September 2026.
Which products and versions are affected?
@vendure/core (npm) < 3.7.0, SEMVER:introduced=0,fixed=3.7.0; Vendure < 3.7.0.
Is there a fix for CVE-2026-63472?
Yes. @vendure/core (npm): upgrade to 3.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63472 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-63472?
Check whether you run @vendure/core (npm) or Vendure at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @vendure/core (npm): upgrade to 3.7.0 or later
    npm install @vendure/core@3.7.0

Technical details

The vulnerability exists in ExternalAuthenticationService.createCustomerAndUser() in @vendure/core, which accepts external authentication claims (OAuth/SSO/custom strategies). When processing a new external login, the service queries for an existing User by email address alone; if found, it attaches the attacker's external authentication method to that existing account without verifying the email ownership claim (the config.verified flag is not checked as a precondition). An AuthenticationStrategy that forwards unverified emails—omitting the provider's email_verified claim or failing to set verified: true—allows account linkage without proof of email ownership. Preconditions: deployment must use at least one external AuthenticationStrategy that permits unverified emails, and victim accounts must exist with matching email addresses. The flaw permits unauthenticated network-level exploitation: an attacker registers at the external provider with a victim's email, triggers authentication, and gains full account access. Patch: upgrade to 3.7.0, which gates external-to-existing linkage on verified: true and requires AuthenticationStrategy implementations to strictly validate provider email verification.

Affected products

  • Vendure @vendure/core < 3.7.0

Identifiers

  • CVE-2026-63472
  • GHSA-6j36-r6pr-59x4

Timeline

  • 2026-07-01: disclosed: Initial advisory published by Vendure team
  • 2026-09-17: patched: Version 3.7.0 released with fix requiring email verification before linking external auth to existing accounts

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.