Shopware Core and Platform are vulnerable to an authentication bypass flaw that permits unauthorized redirection of app traffic and potential credential theft.

The vulnerability involves a flaw in the legacy app registration flow where HMAC based authentication fails to properly bind a shop installation to its original domain. This allows unauthenticated attackers to update the shop URL during re registration without verifying control over the domain, leading to an authentication bypass.

The potential impact of this vulnerability is significant, as it allows attackers to intercept communication between a shop and its integrated apps. By redirecting this traffic and capturing API credentials, an attacker could gain unauthorized access to sensitive business data or perform actions on behalf of the merchant, leading to potential financial loss and data breaches. Given the CVSS score of 8.9, this issue is classified as high severity and requires immediate attention to prevent unauthorized service manipulation.

Immediate Action: Upgrade Shopware Core and Platform installations to version 6.6.10.15 or 6.7.8.1 immediately to patch the registration flow.

Proactive Monitoring: Review application logs for unusual re registration events or unexpected updates to registered shop URLs.

Compensating Controls: Ensure that third party apps integrated with Shopware are reviewed for abnormal traffic patterns and implement strict network egress filtering where feasible.

Public Exploit Available: Unknown

The high severity of this vulnerability, combined with the potential for direct API credential theft, necessitates an urgent response. Administrators should prioritize the deployment of the provided security updates across all affected production environments immediately. Failure to patch these versions leaves the platform susceptible to persistent communication hijacking and unauthorized access to integrated service data.