A timing‑based flaw in the Shopware admin panel allows an attacker to deduce administrator usernames by measuring response times. This weakness, classified as CWE‑208, enables credential reconnaissance without needing valid credentials, potentially aiding future credential‑guessing or brute‑force attacks. The impact is a compromise of confidentiality for administrative identities, but there is no immediate elevation of privileges or data disclosure.

Shopware, versions prior to 6.6.10.18 for the 6.6 branch and prior to 6.7.10.1 for the 6.7 branch, are affected. Users running these releases should verify their install versions and apply the recommended updates.

The CVSS score of 3.7 indicates low overall severity, and the EPSS score is not available, suggesting no recent exploitation data is available. The vulnerability is not listed in CISA KEV, further indicating that widespread attacks are not known. However, the attack vector is inferred to be remote, from any external host able to access the admin panel, making it potentially exploitable if publicly reachable. Given the low CVSS, exploitation risk is considered low but non‑zero for exposed installations.