Description
Shopware is an open commerce platform. Versions 6.7.3.0 through 6.7.10.0 have an open redirect in Shopware's public SSO entry point at `GET /api/oauth/sso/auth`. When the endpoint is reached without the expected SSO session state, the application falls back to the request's `Referer` header and uses that value as the redirect destination. In the validated behavior, the server does not restrict that fallback target to same-origin URLs, does not require a relative path, and does not reject dangerous schemes such as `javascript:`. As a result, an unauthenticated request can turn this endpoint into a reusable redirect primitive whose destination is fully controlled by attacker-supplied request metadata. The security problem is not limited to a harmless navigation mismatch. The endpoint sits under `/api/oauth/`, which gives the redirect a trustworthy application-controlled origin and makes it suitable for phishing chains, branded redirect abuse, and cases where client software automatically follows redirects issued by a trusted host. The attached evidence also shows that the response is not only an HTTP `302` with a user-controlled `Location` header. The HTML body contains a matching meta refresh tag and redirect link built from the same attacker-controlled value. In the validated proof, the endpoint redirects to `https://attacker.example/poc` when that URL is supplied through `Referer`, and it also reflects `javascript:alert(1)` into `Location` and the HTML redirect body without any scheme filtering. This report therefore stays conservative and claims an open redirect with arbitrary redirect targets, while noting that the lack of scheme restrictions makes the behavior materially worse than a same-scheme external redirect. Version 6.7.10.1 fixes the issue.
Published: 2026-07-23
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Shopware versions 6.7.3.0 through 6.7.10.0 have an open‑redirect flaw in the public SSO entry point GET /api/oauth/sso/auth. When this endpoint is accessed without the proper SSO session state, the application falls back to the Referer header and uses that value as the redirect destination. The server performs no same‑origin checks, does not require a relative path, and does not reject dangerous schemes such as javascript:. Consequently an unauthenticated attacker can craft a request that redirects users or client software to any URL of choice, including JavaScript payloads, which can be used for phishing, brand‑abuse, or malicious content delivery. The endpoint resides under /api/oauth/, giving the redirect a trustworthy origin and enabling phishing chains or branded redirect abuse. The response includes a 302 redirect with an attacker‑controlled Location header and an HTML meta refresh and link built from the same value. The issue is fixed in Shopware 6.7.10.1.

Affected Systems

The vulnerability affects the Shopware Platform (shopware:platform) and the Shopware product identified by the CNA as shopware:shopware for all releases from 6.7.3.0 up to 6.7.10.0. The referenced fix is contained in version 6.7.10.1 and all subsequent builds.

Risk and Exploitability

The CVSS score of 4.3 reflects a medium severity because the flaw requires no authentication and can be triggered via a simple GET request to a public endpoint. The EPSS score of less than 1% indicates a low probability of exploitation at present, and the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is Network: External-Untrusted; exploiting the flaw requires only the ability to send a crafted request to the public SSO endpoint and provide a Referer header of an attacker‑controlled destination.

Generated by OpenCVE AI on August 3, 2026 at 21:04 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to Shopware version 6.7.10.1 or later, where the redirect logic has been corrected.
  • Implement server‑side validation that rejects redirects to external domains, disallows non‑HTTP/HTTPS schemes, and forces a valid SSO session state before generating a redirect.
  • Audit and refactor any custom redirect or referer handling code to enforce same‑origin checks or a whitelist of allowed targets.

Generated by OpenCVE AI on August 3, 2026 at 21:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-4x3x-869w-xx3m Shopware SSO referer trust leading to an arbitrary redirect target
History

Fri, 24 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 24 Jul 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Shopware
Shopware platform
Shopware shopware
Vendors & Products Shopware
Shopware platform
Shopware shopware

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description Shopware is an open commerce platform. Versions 6.7.3.0 through 6.7.10.0 have an open redirect in Shopware's public SSO entry point at `GET /api/oauth/sso/auth`. When the endpoint is reached without the expected SSO session state, the application falls back to the request's `Referer` header and uses that value as the redirect destination. In the validated behavior, the server does not restrict that fallback target to same-origin URLs, does not require a relative path, and does not reject dangerous schemes such as `javascript:`. As a result, an unauthenticated request can turn this endpoint into a reusable redirect primitive whose destination is fully controlled by attacker-supplied request metadata. The security problem is not limited to a harmless navigation mismatch. The endpoint sits under `/api/oauth/`, which gives the redirect a trustworthy application-controlled origin and makes it suitable for phishing chains, branded redirect abuse, and cases where client software automatically follows redirects issued by a trusted host. The attached evidence also shows that the response is not only an HTTP `302` with a user-controlled `Location` header. The HTML body contains a matching meta refresh tag and redirect link built from the same attacker-controlled value. In the validated proof, the endpoint redirects to `https://attacker.example/poc` when that URL is supplied through `Referer`, and it also reflects `javascript:alert(1)` into `Location` and the HTML redirect body without any scheme filtering. This report therefore stays conservative and claims an open redirect with arbitrary redirect targets, while noting that the lack of scheme restrictions makes the behavior materially worse than a same-scheme external redirect. Version 6.7.10.1 fixes the issue.
Title Shopware SSO referer trust leading to an arbitrary redirect target
Weaknesses CWE-601
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}

Subscriptions

Shopware Platform Shopware
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-24T13:31:43.099Z

Reserved: 2026-05-20T17:44:09.586Z

Link: CVE-2026-48012

cve-icon Vulnrichment

Updated: 2026-07-24T13:31:37.320Z

cve-icon NVD

Status : Deferred

Published: 2026-07-23T20:17:08.777

Modified: 2026-07-28T16:17:16.127

Link: CVE-2026-48012

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T21:15:04Z

Weaknesses
  • CWE-601

    URL Redirection to Untrusted Site ('Open Redirect')