CVE-2026-31889 - Vulnerability Analysis

Overview

Shopware < 6.6.10.15 and < 6.7.8.1 contains a broken authentication caused by insufficient binding of shop installation to original domain in app registration flow, letting attackers hijack app communication and obtain API credentials, exploit requires possession of app-side secret.

Severity & Score

Impact

Attackers can hijack app communication and obtain API credentials, leading to unauthorized access to shop data and operations.

Mitigation

Update to versions 6.6.10.15 and 6.7.8.1 or later.

References

• https://github.com/shopware/shopware/security/advisories/GHSA-c4p7-rwrg-pf6p

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner