A Reflected XSS vulnerability in the Shopware commerce platform allows unauthenticated attackers to execute arbitrary code within the user session, posing a significant risk to site integrity.

The vulnerability exists in AuthController.php, where the waitTime request parameter is rendered in the Storefront login page without proper input validation or sanitization. This flaw allows an unauthenticated attacker to inject malicious scripts that execute in the context of a victim user's browser.

Successful exploitation allows an attacker to perform actions on behalf of the user, potentially stealing session cookies, redirecting users to malicious sites, or modifying page content. With a CVSS score of 7.1, this high-severity vulnerability represents a significant risk to customer trust and data security. Unauthorized access to administrative or user sessions can lead to further compromise of the commerce platform.

Immediate Action: Update Shopware to version 6.6.10.10 or 6.7.5.1 immediately to apply the necessary input sanitization fixes.

Proactive Monitoring: Review web server access logs for anomalous requests containing script tags or suspicious URL parameters directed at the login endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with configured rules to detect and block reflected XSS patterns in URL parameters until the patch can be applied.

Public Exploit Available: Unknown.

Given the high severity of this vulnerability and the potential for session hijacking, administrators should prioritize the deployment of the provided security updates. Failure to patch the AuthController component leaves the storefront vulnerable to malicious script injection, which could be used to manipulate user interactions or compromise sensitive account information. Apply the recommended versions to all affected instances without delay.