CVE-2026-48011

Name of the Vulnerable Software and Affected Versions Shopware versions prior to 6.6.10.18 Shopware versions prior to 6.7.10.1

Description An attacker can enumerate administrator usernames by performing a timing attack. This occurs because the getUserEntityByUserCredentials() function in the api/oauth/token endpoint handles requests differently depending on whether a username exists. If a username is not found, the system returns a response immediately. However, if the username is found, the system executes the password verify() function, which uses the Argon2id hashing algorithm. Argon2id is intentionally slow to prevent brute-force attacks, creating a measurable difference in response time between existing and non-existing users.

Recommendations Update to version 6.6.10.18. Update to version 6.7.10.1.