Detections
Analytics

SCA: security update for shopware/core, shopware/platform (GHSA-4x3x-869w-xx3m)

medium Tenable Cloud Security Plugin ID 442658

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Shopware is an open commerce platform. Versions 6.7.3.0 through 6.7.10.0 have an open redirect in
 Shopware's public SSO entry point at `GET /api/oauth/sso/auth`. When the endpoint is reached without the
 expected SSO session state, the application falls back to the request's `Referer` header and uses that
 value as the redirect destination. In the validated behavior, the server does not restrict that fallback
 target to same-origin URLs, does not require a relative path, and does not reject dangerous schemes such
 as `javascript:`. As a result, an unauthenticated request can turn this endpoint into a reusable redirect
 primitive whose destination is fully controlled by attacker-supplied request metadata. The security
 problem is not limited to a harmless navigation mismatch. The endpoint sits under `/api/oauth/`, which
 gives the redirect a trustworthy application-controlled origin and makes it suitable for phishing chains,
 branded redirect abuse, and cases where client software automatically follows redirects issued by a
 trusted host. The attached evidence also shows that the response is not only an HTTP `302` with a user-
 controlled `Location` header. The HTML body contains a matching meta refresh tag and redirect link built
 from the same attacker-controlled value. In the validated proof, the endpoint redirects to
 `https://attacker.example/poc` when that URL is supplied through `Referer`, and it also reflects
 `javascript:alert(1)` into `Location` and the HTML redirect body without any scheme filtering. This report
 therefore stays conservative and claims an open redirect with arbitrary redirect targets, while noting
 that the lack of scheme restrictions makes the behavior materially worse than a same-scheme external
 redirect. Version 6.7.10.1 fixes the issue. (CVE-2026-48012)

Solution

Update the shopware/core library and its related packages to version 6.7.10.1 or later.

See Also

https://github.com/advisories/GHSA-4x3x-869w-xx3m

Plugin Details

Severity: Medium

ID: 442658

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 6/5/2026

Updated: 7/24/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2026-48012

CVSS v3

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/4/2026

Vulnerability Publication Date: 6/4/2026

Reference Information

CVE: CVE-2026-48012

cwe: CWE-601