CVE-2026-48012
Received Received - Intake

Open Redirect in Shopware Public SSO Entry Point

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: GitHub, Inc.

Description
Shopware is an open commerce platform. Versions 6.7.3.0 through 6.7.10.0 have an open redirect in Shopware's public SSO entry point at `GET /api/oauth/sso/auth`. When the endpoint is reached without the expected SSO session state, the application falls back to the request's `Referer` header and uses that value as the redirect destination. In the validated behavior, the server does not restrict that fallback target to same-origin URLs, does not require a relative path, and does not reject dangerous schemes such as `javascript:`. As a result, an unauthenticated request can turn this endpoint into a reusable redirect primitive whose destination is fully controlled by attacker-supplied request metadata. The security problem is not limited to a harmless navigation mismatch. The endpoint sits under `/api/oauth/`, which gives the redirect a trustworthy application-controlled origin and makes it suitable for phishing chains, branded redirect abuse, and cases where client software automatically follows redirects issued by a trusted host. The attached evidence also shows that the response is not only an HTTP `302` with a user-controlled `Location` header. The HTML body contains a matching meta refresh tag and redirect link built from the same attacker-controlled value. In the validated proof, the endpoint redirects to `https://attacker.example/poc` when that URL is supplied through `Referer`, and it also reflects `javascript:alert(1)` into `Location` and the HTML redirect body without any scheme filtering. This report therefore stays conservative and claims an open redirect with arbitrary redirect targets, while noting that the lack of scheme restrictions makes the behavior materially worse than a same-scheme external redirect. Version 6.7.10.1 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-23
Last Modified
2026-07-23
Generated
2026-07-24
AI Q&A
2026-07-23
EPSS Evaluated
N/A
NVD
CVE-2026-48012

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
shopware shopware From 6.7.3.0 (inc) to 6.7.10.0 (inc)
shopware shopware 6.7.10.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-48012 is an open redirect vulnerability in Shopware's Single Sign-On (SSO) functionality. It occurs in the public SSO entry point at GET /api/oauth/sso/auth. When the expected SSO session state is missing, the application incorrectly uses the Referer header as a fallback redirect destination. This allows an unauthenticated attacker to control the redirect target by manipulating the Referer header, including setting dangerous schemes like 'javascript:'.

The vulnerability affects Shopware versions 6.7.3.0 to 6.7.10.0 and has been patched in version 6.7.10.1. The issue enables phishing attacks, brand impersonation, and redirect chaining through a legitimate Shopware origin.

Detection Guidance

To detect this vulnerability, monitor HTTP requests to the endpoint GET /api/oauth/sso/auth in Shopware versions 6.7.3.0 through 6.7.10.0. Check if the Referer header is used to set arbitrary redirect targets, including non-HTTP schemes like javascript:. Use network logs or WAF rules to identify suspicious redirects originating from this path.

Impact Analysis

This vulnerability can be exploited by attackers to redirect users to malicious websites. The attacker can craft a link that, when clicked, sends the user to a trusted Shopware domain before redirecting to a malicious site. This could lead to phishing attacks, credential theft, or malware downloads. The lack of scheme restrictions means attackers could also inject 'javascript:' URLs, potentially executing arbitrary code in the user's browser.

Since the redirect appears to come from a trusted Shopware domain, users are more likely to trust the link, increasing the success rate of such attacks. Client software that automatically follows redirects may exacerbate the issue.

Mitigation Strategies

Immediately upgrade Shopware to version 6.7.10.1 or later to patch the vulnerability. If upgrading is not possible, restrict access to the /api/oauth/sso/auth endpoint or implement server-side validation to block external or dangerous redirect targets. Review and update WAF rules to detect and block malicious Referer headers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48012. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart