Listen to this Post
Vendure is an open-source headless commerce platform. Prior to version 3.7.0, a critical vulnerability exists in the `ExternalAuthenticationService.createCustomerAndUser()` method. This flaw allows an attacker to take over a victim’s account by exploiting the external authentication linking process. The vulnerability stems from the service linking a newly presented external authentication method (like OAuth or social login) to a pre-existing user account based solely on an email address match. Crucially, this linking occurs without requiring the `config.verified` flag to be true. This means that if a custom `AuthenticationStrategy` forwards an email address that the external provider has not actually verified, an attacker can exploit this. The attacker would register at the external provider using the victim’s email address. When they then authenticate through the store’s external login, the system finds the victim’s existing account by that email and attaches the attacker’s external identity to it. The `config.verified` flag is only used to set the `User.verified` status and write a history entry, but it never gates whether the external method may be attached to an existing account. This silent linking process results in a full account takeover. The attacker gains access to the victim’s orders, addresses, personal information, and can place orders on their behalf. The severity is critical because it requires no special privileges and can be executed over the network. The vulnerability is classified as CWE-287: Improper Authentication.
DailyCVE Form:
Platform: Vendure
Version: < 3.7.0
Vulnerability: Account Takeover
Severity: Critical
date: 2026-09-17
Prediction: Patch available (3.7.0)
What Undercode Say
Bash command to check package version:
npm list @vendure/core
Vulnerable code snippet:
const existingUser = await this.findExistingCustomerUserByEmailAddress(ctx, config.emailAddress);
if (existingUser) {
user = existingUser; // <-- links to the EXISTING account, by email alone
} else {
user = new User({ identifier: config.emailAddress, verified: config.verified || false, ... });
}
const authMethod = await this.connection.getRepository(ctx, ExternalAuthenticationMethod).save(
new ExternalAuthenticationMethod({
externalIdentifier: config.externalIdentifier,
strategy: config.strategy
}),
);
user.authenticationMethods = [...(user.authenticationMethods || []), authMethod]; // <-- external login attached
await this.connection.getRepository(ctx, User).save(user);
Exploit: (Educational Purposes!)
Conceptual reproduction steps:
- Victim has a native Vendure customer account
[email protected]. - Attacker authenticates through an external provider configured on the store, presenting `emailAddress = [email protected]` with `verified` unset or false.
3. `createCustomerAndUser` finds the victim’s existing User by email and attaches the attacker’sExternalAuthenticationMethod. - Attacker logs in via that external method and is authenticated as the victim.
Protection: from this CVE
Upgrade to Vendure 3.7.0 or later. After upgrading, an external login is only linked to a pre-existing account when the email is verified. Ensure that custom `AuthenticationStrategy` implementations only set `verified: true` for emails the provider has actually verified. Review and audit all custom external authentication strategies to confirm they strictly validate provider-verified email ownership.
Impact:
Account takeover of any customer whose email address an attacker can present via an unverified external auth provider. Attackers can read and modify the victim’s orders, addresses, and PII, and place orders as them. The blast radius depends on the deployed `AuthenticationStrategy` implementations.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
