CVE-2026-45055 - Vulnerability Analysis

Overview

CubeCart 6.6.x – 6.7.1 contains an open redirect caused by building CC_STORE_URL from the Host header without allowlist, letting unauthenticated attackers perform account takeover via crafted password-reset links, exploit requires attacker to know target email.

Severity & Score

Impact

Unauthenticated attackers can take over user or admin accounts by exploiting password reset links, leading to full account or store compromise.

Mitigation

Upgrade to version 6.7.2 or later.

References

• https://github.com/cubecart/v6/security/advisories/GHSA-7pvc-gxc4-chmc

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner