CVE-2026-63472 Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification
Attackers can take over victim accounts by linking unverified external identities to existing emails in custom authentication setups.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-63472?
CVE-2026-63472 is a critical authentication bypass vulnerability in vendurehq vendure, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Vendure is an open-source headless commerce platform. Prior to 3.7.0, ExternalAuthenticationService.createCustomerAndUser in packages/core/src/service/helpers/external-authentication/external-authentication.service.ts selects an existing customer user by emailAddress and attaches a newly presented ExternalAuthenticationMethod without requiring verified to be true. In deployments with a custom external AuthenticationStrategy that forwards an email whose ownership the provider has not verified, an attacker can authenticate with a victim's email and bind the attacker's external identity to the victim's existing account. This can expose orders, addresses, and personal information and permit account changes or orders as the victim. Native-only email and password deployments and external strategies that always require provider-verified email ownership are unaffected, and new-account creation for an unused email remains permitted. This issue is fixed in version 3.7.0.
Weakness: CWE-287
Which versions are affected by CVE-2026-63472?
2 open source packages ship an affected version, including @vendure/core.
| Package | Affected | Fixed in |
|---|---|---|
@vendure/core npm | All versions | 3.7.0 |
@vendure/core npm | All versions | 3.7.0 |
How do I fix CVE-2026-63472?
Upgrade @vendure/core to 3.7.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-63472 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-63472 exists.
Sources
Also known as GHSA-6j36-r6pr-59x4.