The vulnerability resides in the Shopware app registration flow. The legacy flow uses HMAC‑based authentication but fails to tie a shop installation to its original domain. When an app is re‑registered, the shop‑URL can be changed without proving control over the previous domain. This allows an attacker who knows the app‑side secret to hijack the communication channel, redirect traffic to a domain controlled by the attacker, and potentially capture API credentials intended for the legitimate shop. The weakness corresponds to CWE‑290 (Authorization Bypass Through Privileged Credentials). The primary impact is the theft of API credentials, which can lead to further compromise or unauthorized control over the shop.

Affected products are Shopware core and Shopware platform. Versions prior to 6.6.10.15 and 6.7.8.1 are vulnerable.

The CVSS score is 8.9 (High). EPSS score is less than 1%, indicating a low probability of exploitation in the wild. The vulnerability is not listed in CISA's KEV catalog. Exploitation requires the attacker to possess the app’s secret and to trigger the re‑registration process, which limits the attack surface. Nevertheless, the high severity and potential for credential theft justify immediate patching.