Reflected XSS in Shopware Open Commerce Platform
CVE-2025-67648

7.1HIGH

Key Information:

Vendor

Shopware

Status
Shopware
Vendor
CVE Published:
10 December 2025

What is CVE-2025-67648?

The Shopware Open Commerce Platform has a vulnerability that allows attackers to exploit reflected cross-site scripting (XSS) in the AuthController.php file. The flaw arises when a request parameter from the login page URL is rendered directly in the Twig template of the Storefront login page without sufficient processing or input validation. This could enable attackers to inject malicious code into the template via the 'waitTime' URL parameter. The issue has been addressed and patched in the subsequent versions 6.6.10.10 and 6.7.5.1.

Affected Version(s)

shopware >= 6.4.6.0, < 6.6.10.10 < 6.4.6.0, 6.6.10.10

shopware >= 6.7.0.0, < 6.7.5.1 < 6.7.0.0, 6.7.5.1

References

https://github.com/shopware/shopware/security/advisories/...
x_refsource_CONFIRM
https://github.com/shopware/shopware/commit/c9242c02c8459...
x_refsource_MISC

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.