CVE-2026-48012

Name of the Vulnerable Software and Affected Versions Shopware versions 6.7.3.0 through 6.7.10.0

Description An open redirect exists in the public SSO entry point at GET /api/oauth/sso/auth. When the endpoint is accessed without the expected SSO session state, the application uses the Referer header as the redirect destination. The server does not restrict this target to same-origin URLs, does not require a relative path, and does not reject dangerous schemes such as javascript:. Consequently, an unauthenticated request can use this endpoint as a redirect primitive controlled by attacker-supplied metadata. The response includes an HTTP 302 status with a user-controlled Location header, as well as a meta refresh tag and a redirect link in the HTML body. This behavior can be leveraged for phishing chains and branded redirect abuse, as the redirect originates from a trusted /api/oauth/ path.

Recommendations Update to version 6.7.10.1. As a temporary workaround, restrict access to the GET /api/oauth/sso/auth endpoint to minimize the risk of exploitation.