# CVE-2026-63472: Vendure account takeover in external authentication

Source: https://junglewise.ai/threats/cve-2026-63472-vendure-account-takeover-in-external-authentication  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-63472 · Severity: critical · CVSS 9.1 · Published 2026-09-17

Vendure, a popular Node.js e-commerce platform, has a critical authentication flaw in its external login (OAuth/SSO) feature. If a store uses social login or custom OAuth without properly verifying email ownership, an attacker can register at the external provider using a victim's email address and automatically gain control of their existing Vendure account, allowing them to view and modify orders, addresses, payment info, and place fraudulent purchases.

Technologies: [@vendure/core (npm)](https://junglewise.ai/threats/technologies/vendure-core). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-63472 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63472 being exploited in the wild.

**How severe is CVE-2026-63472?** Critical severity, with a CVSS score of 9.1, published 17 September 2026.

**Which products and versions are affected?** @vendure/core (npm) < 3.7.0, SEMVER:introduced=0,fixed=3.7.0; Vendure < 3.7.0.

**Is there a fix for CVE-2026-63472?** Yes. @vendure/core (npm): upgrade to 3.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63472 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-63472?** Check whether you run @vendure/core (npm) or Vendure at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @vendure/core (npm): upgrade to 3.7.0 or later

  ```sh
  npm install @vendure/core@3.7.0
  ```


## Technical details

The vulnerability exists in ExternalAuthenticationService.createCustomerAndUser() in @vendure/core, which accepts external authentication claims (OAuth/SSO/custom strategies). When processing a new external login, the service queries for an existing User by email address alone; if found, it attaches the attacker's external authentication method to that existing account without verifying the email ownership claim (the config.verified flag is not checked as a precondition). An AuthenticationStrategy that forwards unverified emails—omitting the provider's email_verified claim or failing to set verified: true—allows account linkage without proof of email ownership. Preconditions: deployment must use at least one external AuthenticationStrategy that permits unverified emails, and victim accounts must exist with matching email addresses. The flaw permits unauthenticated network-level exploitation: an attacker registers at the external provider with a victim's email, triggers authentication, and gains full account access. Patch: upgrade to 3.7.0, which gates external-to-existing linkage on verified: true and requires AuthenticationStrategy implementations to strictly validate provider email verification.

## Affected products

- Vendure @vendure/core < 3.7.0

## Identifiers

- CVE-2026-63472
- GHSA-6j36-r6pr-59x4

## Timeline

- 2026-07-01: disclosed: Initial advisory published by Vendure team
- 2026-09-17: patched: Version 3.7.0 released with fix requiring email verification before linking external auth to existing accounts

## References

- [https://api.github.com/users/squinard1478](https://api.github.com/users/squinard1478)
- [https://github.com/squinard1478](https://github.com/squinard1478)
- [https://api.github.com/users/squinard1478/gists%7B/gist_id%7D](https://api.github.com/users/squinard1478/gists%7B/gist_id%7D)
- [https://api.github.com/users/squinard1478/repos](https://api.github.com/users/squinard1478/repos)
- [https://avatars.githubusercontent.com/u/130413164?v=4](https://avatars.githubusercontent.com/u/130413164?v=4)
- [https://api.github.com/users/squinard1478/events%7B/privacy%7D](https://api.github.com/users/squinard1478/events%7B/privacy%7D)

## Related threats

- [Vendure Shop API authorization bypass via filterOperator](https://junglewise.ai/threats/cve-2026-63461-vendure-shop-api-authorization-bypass-via-filteroperator)
- [Vendure unauthenticated ReDoS in regex filter on SQLite](https://junglewise.ai/threats/cve-2026-63460-vendure-unauthenticated-redos-in-regex-filter-on-sqlite)
- [Vendure cross-channel authorization bypass in StockLocation and Asset services](https://junglewise.ai/threats/cve-2026-67347-vendure-cross-channel-authorization-bypass-in-stocklocation-and)
- [@vendure/core has a SQL Injection vulnerability](https://junglewise.ai/threats/cve-2026-40887-vendure-core-has-a-sql-injection-vulnerability)
- [Vendure timing attack enables user enumeration in NativeAuthenticationStrategy](https://junglewise.ai/threats/cve-2026-25050-vendure-timing-attack-enables-user-enumeration-in)