Executive brief
An e-commerce template's payment checkout API endpoint fails to authenticate users before disclosing sensitive buyer information such as name, email, phone, billing address, and purchase amount. An attacker who obtains a checkout session ID—which is commonly exposed in browser URLs, referrer logs, and analytics—can retrieve full details of any buyer's transaction without any credentials, leading to privacy violations and potential identity theft.
Technical details
The vulnerability is a missing authentication check (CWE-306) in the GET /api/stripe/checkout_sessions endpoint (src/app/api/stripe/checkout_sessions/route.ts). The handler retrieves a Stripe checkout session object using stripe.checkout.sessions.retrieve() and returns it directly without verifying that the requesting user is authenticated or owns the session. The session ID is exposed in the buyer's own post-payment success URL (?session_id={CHECKOUT_SESSION_ID}), leaking through HTTP Referer headers, analytics platforms, server logs, and browser history on shared machines. No credentials are required—any attacker holding a valid session ID can call the endpoint to retrieve the complete session object including PII. The fix (commit 91e273c) adds authentication via auth.api.getSession() and ownership validation by comparing the session's userId metadata against the authenticated user's ID.
Affected products
- MarcosCamara01 Ecommerce Template before commit 91e273c (2026-08-01)
Timeline
- 2026-09-14: disclosed: CVE-2026-90896 published
- 2026-08-01: patched: Fix released in commit 91e273c on master branch