CVE-2026-31889 Shopware has a potential take over of app credentials
Attackers can hijack app communication channels and steal API credentials by exploiting insufficient domain binding in the legacy app registration flow.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31889?
CVE-2026-31889 is a high-severity authentication bypass vulnerability in Shopware Shopware, published on 11 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Shopware is an open commerce platform. Prior to 6.6.10.15 and 6.7.8.1, a vulnerability in the Shopware app registration flow that could, under specific conditions, allow attackers to take over the communication channel between a shop and an app. The legacy app registration flow used HMAC‑based authentication without sufficiently binding a shop installation to its original domain. During re‑registration, the shop-url could be updated without proving control over the previously registered shop or domain. This made targeted hijacking of app communication feasible if an attacker possessed the relevant app‑side secret. By abusing app re‑registration, an attacker could redirect app traffic to an attacker‑controlled domain and potentially obtain API credentials intended for the legitimate shop. This vulnerability is fixed in 6.6.10.15 and 6.7.8.1.
Weakness: CWE-290
Which versions are affected by CVE-2026-31889?
8 open source packages ship an affected version, including shopware/core and shopware/platform. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
shopware/core Packagist | All versions | 6.6.10.15 |
shopware/core Packagist | All versions | 6.6.10.15 |
shopware/core Packagist | From 6.7.0.0 | 6.7.8.1 |
shopware/core Packagist | From 6.7.0.0 | 6.7.8.1 |
shopware/platform Packagist | All versions | 6.6.10.15 |
shopware/platform Packagist | All versions | 6.6.10.15 |
2 more packages
shopware/platform Packagist | From 6.7.0.0 | 6.7.8.1 |
shopware/platform Packagist | From 6.7.0.0 | 6.7.8.1 |
Products include Shopware Shopware.
How do I fix CVE-2026-31889?
Upgrade shopware/core to a fixed version for your release line: 6.6.10.15 or 6.7.8.1.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-31889 being exploited?
There is no known exploitation of CVE-2026-31889 in the wild and no public exploit code.
Other vulnerabilities in Shopware Shopware
- CVE-2023-22731 Improper Control of Generation of Code in Twig rendered views in shopware
- CVE-2016-3109 Shopware RCE Vulnerability
- CVE-2024-22406 Blind SQL-injection in DAL aggregations in Shopware
- CVE-2021-32711 Leak of information via Store-API
- CVE-2026-31887 Shopware unauthenticated data extraction possible through store-api.order endpoint
Sources
Also known as GHSA-c4p7-rwrg-pf6p.