Is CVE-2026-90896 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-90896 being exploited in the wild.

How severe is CVE-2026-90896?

Informational severity, with a CVSS score of 8.2, published 14 September 2026.

Which products and versions are affected?

MarcosCamara01 Ecommerce Template before commit 91e273c (2026-08-01).

Is there a fix for CVE-2026-90896?

A patch was published on 2026-08-01: Fix released in commit 91e273c on master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-90896 attacked?

It is attacked over the network.

Am I affected by CVE-2026-90896?

Check whether you run MarcosCamara01 Ecommerce Template at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90896: Ecommerce Template missing authentication in checkout session lookup

CVE-2026-90896 · Severity: info · CVSS 8.2 · Published 2026-09-14

An e-commerce template's payment checkout API endpoint fails to authenticate users before disclosing sensitive buyer information such as name, email, phone, billing address, and purchase amount. An attacker who obtains a checkout session ID—which is commonly exposed in browser URLs, referrer logs, and analytics—can retrieve full details of any buyer's transaction without any credentials, leading to privacy violations and potential identity theft.

Technologies: MarcosCamara01 Ecommerce Template. Vendors: MarcosCamara01.

Quick answers

Is CVE-2026-90896 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-90896 being exploited in the wild.
How severe is CVE-2026-90896?: Informational severity, with a CVSS score of 8.2, published 14 September 2026.
Which products and versions are affected?: MarcosCamara01 Ecommerce Template before commit 91e273c (2026-08-01).
Is there a fix for CVE-2026-90896?: A patch was published on 2026-08-01: Fix released in commit 91e273c on master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-90896 attacked?: It is attacked over the network.
Am I affected by CVE-2026-90896?: Check whether you run MarcosCamara01 Ecommerce Template at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a missing authentication check (CWE-306) in the GET /api/stripe/checkout_sessions endpoint (src/app/api/stripe/checkout_sessions/route.ts). The handler retrieves a Stripe checkout session object using stripe.checkout.sessions.retrieve() and returns it directly without verifying that the requesting user is authenticated or owns the session. The session ID is exposed in the buyer's own post-payment success URL (?session_id={CHECKOUT_SESSION_ID}), leaking through HTTP Referer headers, analytics platforms, server logs, and browser history on shared machines. No credentials are required—any attacker holding a valid session ID can call the endpoint to retrieve the complete session object including PII. The fix (commit 91e273c) adds authentication via auth.api.getSession() and ownership validation by comparing the session's userId metadata against the authenticated user's ID.

Affected products

MarcosCamara01 Ecommerce Template before commit 91e273c (2026-08-01)

Timeline

2026-09-14: disclosed: CVE-2026-90896 published
2026-08-01: patched: Fix released in commit 91e273c on master branch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.