A missing authentication vulnerability in the MarcosCamara01 Ecommerce Template allows unauthenticated attackers to exfiltrate customer personally identifiable information by accessing the checkout session lookup handler.

This vulnerability, categorized as CWE-306, exists in the checkout session lookup handler (src/app/api/stripe/checkout_sessions/route.ts) because it fails to perform authentication or ownership verification. An unauthenticated attacker who obtains a valid Stripe Checkout Session ID can query the endpoint to retrieve full buyer details, including name, email, phone, and billing address.

The exploitation of this flaw leads to the unauthorized disclosure of sensitive customer PII, which poses a severe risk of data privacy violations and potential regulatory non-compliance. Given the CVSS score of 8.2, this vulnerability is classified as high severity, as it facilitates the mass harvesting of buyer data if session IDs are intercepted through common channels like browser history or server logs.

Immediate Action: Update your deployment to include commit 91e273c or later, which implements mandatory session authentication and ownership validation for the affected endpoint.

Proactive Monitoring: Review web server and application logs for unusual spikes in GET requests to the /api/stripe/checkout_sessions endpoint, especially those originating from unexpected IP addresses.

Compensating Controls: Implement strict access control lists at the Web Application Firewall (WAF) or API gateway level to restrict access to the checkout API, and consider rotating existing Stripe session IDs if unauthorized access is suspected.

Public Exploit Available: No (unknown)

The severity of this issue necessitates immediate attention, as it directly exposes customer financial and contact data. Organizations utilizing this template must prioritize patching by pulling the latest code from the master branch to incorporate the required authentication logic, thereby preventing unauthorized access to sensitive checkout sessions.