| Package | Affected versions | Patched versions |
|---|---|---|
| shopware/core | ≥ 6.7.0.0, < 6.7.4.1< 6.6.10.9 | 6.7.4.16.6.10.9 |
When a customer changes their email address after requesting a password reset, the old password reset link (tied to the previous email) remains valid. An attacker with access to the old email inbox is potentially able to reset the customer’s password even after the user changes their email address.
Reproduced on Stable 6.6.10.7 and trunk.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free