Authentication Flaw in Vendure Open-Source Commerce Platform

CVE-2026-63472

What is CVE-2026-63472?

In Vendure, an open-source headless commerce platform, an authentication flaw exists in the ExternalAuthenticationService prior to version 3.7.0. This vulnerability allows an attacker to authenticate as a victim by leveraging an email address that the provider has not verified. When utilizing a custom external authentication strategy, the attacker's identity can be bound to the victim's existing account, leading to unauthorized access to sensitive information such as orders and personal details. Deployments using native email and password authentication or those requiring verified email ownership for external strategies are not affected. The issue has been resolved in version 3.7.0.

References