Open Redirect Vulnerability in Shopware by Shopware

CVE-2026-48012

What is CVE-2026-48012?

Shopware, an open commerce platform, is affected by an open redirect vulnerability in its public SSO entry point located at /api/oauth/sso/auth. In versions 6.7.3.0 through 6.7.10.0, when accessed without a proper SSO session state, the application may redirect users based on the Referer header sent by attackers. This flaw allows for potentially harmful redirects which can lead to phishing attacks and abuse of trusted application origins. The server does not limit the redirect target to same-origin URLs and fails to filter dangerous schemes like javascript:, enabling malicious actors to exploit this endpoint. The security issue is exemplified by the fact that not only does the server respond with a user-controlled Location header but also includes this in the HTML body as a meta refresh link, effectively turning the redirect into a risk for users following links from trusted sources. The vulnerability was addressed in version 6.7.10.1.

References