CVE-2026-90896

Received Received - Intake

Authentication Bypass in Ecommerce Template

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: Secur0

Description

Missing Authentication for Critical Function (CWE-306) in the checkout session lookup handler (src/app/api/stripe/checkout_sessions/route.ts), exposed at GET /api/stripe/checkout_sessions, in MarcosCamara01 Ecommerce Template before commit 91e273c allows a remote, unauthenticated attacker holding a valid Stripe Checkout Session id (cs_...) to retrieve the full session object, including the buyer's name, email, phone, billing address, amount paid and internal userId, because the GET handler calls stripe.checkout.sessions.retrieve() and returns the result without checking for an authenticated session or session ownership. Sibling endpoints such as POST /api/stripe/payment already enforced authentication via auth.api.getSession(); this endpoint had no access control whatsoever. The session_id is exposed in the buyer's own browser URL after payment (success_url = /result?session_id={CHECKOUT_SESSION_ID}), so it leaks through Referer headers, analytics tools, server access logs and shared-machine browser history, resulting in disclosure of the buyer's personal data to an unauthenticated actor.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-14

Generated

2026-09-15

AI Q&A

2026-09-15

EPSS Evaluated

N/A

NVD

CVE-2026-90896

Affected Vendors & Products

Vendor	Product	Version / Range
marcoscamara01	ecommerce_template	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability is a Missing Authentication for Critical Function (CWE-306) in an ecommerce template. It allows an unauthenticated attacker with a valid Stripe Checkout Session ID to retrieve sensitive buyer data like name, email, phone, billing address, and payment amount via an exposed API endpoint (GET /api/stripe/checkout_sessions). The endpoint does not verify authentication or session ownership before returning full session details.

Impact Analysis

If you use this ecommerce template, an attacker could exploit this to steal customers' personal and payment data. The session ID is exposed in browser URLs and logs, making it accessible to unauthorized parties. This could lead to identity theft, financial fraud, or reputational damage for your business.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to personal and payment data. GDPR requires protecting personal data, and HIPAA mandates safeguarding health-related payment information. Non-compliance could result in legal penalties, fines, and loss of customer trust.

Mitigation Strategies

Immediately restrict access to the endpoint GET /api/stripe/checkout_sessions by implementing authentication checks similar to the POST /api/stripe/payment endpoint. Ensure only authorized sessions can retrieve checkout session data.

Hi! I’m here to help you understand CVE-2026-90896. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70