MediumGHSA-2w46-vq8h-98vh

Shopware 6's password recovery link does not expire after email change

Published 14 Nov 2025 · Updated 10 Sept 2026

Affected packages

shopware/coreComposer

Affected: <6.6.10.9
Fixed in: 6.6.10.9

Update to the fixed version for your release line, for example:composer require shopware/core:^6.6.10.9

shopware/coreComposer

Affected: >=6.7.0.0 <6.7.4.1
Fixed in: 6.7.4.1

Update to the fixed version for your release line, for example:composer require shopware/core:^6.7.4.1

Details

Summary

When a customer changes their email address after requesting a password reset, the old password reset link (tied to the previous email) remains valid. An attacker with access to the old email inbox is potentially able to reset the customer’s password even after the user changes their email address.

PoC

1. Log in to a Shopware account. 2. Request a password reset for your current email address. 3. Copy the password reset link but do not open it. 4. Log back into your account.n 5. Navigate to Account Settings → Email and change your email address. 6. Use the previously copied reset link (from before the email change). 7. The system allows password change using the old link.

Impact

Reproduced on Stable 6.6.10.7 and trunk.

Is GHSA-2w46-vq8h-98vh in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected shopware/core, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.