vendure-core

# External-authentication account takeover: external login linked to a pre-existing account by email without requiring verification **Package:** @vendure/core (vendure-ecommerce/vendure, latest master) · > [!IMPORTANT] > This vulnerability **only affects deployments that use external / social authentication** (an `AuthenticationStrategy` other than the built-in native email/password strategy) where that strategy can return an email address the external provider has **not verified** the user owns. **You are affected if all of these are true:** - Your store configures one or more external `A

CVE: CVE-2026-63472

### Summary > [!IMPORTANT] > Only instances running on the SQLite driver (better-sqlite3) are affected; SQLite is usually used in development/testing backend, so production deployments on PostgreSQL or MySQL/MariaDB are unaffected. The `StringOperators.regex` filter exposed on the public Shop GraphQL API is evaluated inside the Node.js event loop via a synchronous SQLite user-defined function (UDF). Supplying a catastrophically backtracking pattern blocks the entire event loop, causing a complete denial of service with no authentication required. --- ### Details Vendure registers a JavaS

CVE: CVE-2026-63460

The Shop API `products`, `collections` and `facets` queries inject a mandatory filter to restrict results to publicly-visible entities (`Product.enabled = true`, `Collection.isPrivate = false`, `Facet.isPrivate = false`). This injected guard was combined with the caller-supplied filter using the caller-controlled `filterOperator`. When a caller sets `filterOperator: OR`, the guard is OR-combined instead of AND-combined, so a caller can retrieve disabled products and private collections/facets by supplying a predicate that matches them. ### Impact Exposure of catalog entities intended to be hi

CVE: CVE-2026-63461

## Summary An unauthenticated SQL injection vulnerability exists in the Vendure Shop API. A user-controlled query string parameter is interpolated directly into a raw SQL expression without parameterization or validation, allowing an attacker to execute arbitrary SQL against the database. This affects all supported database backends (PostgreSQL, MySQL/MariaDB, SQLite). The Admin API is also affected, though exploitation there requires authentication. ## Affected versions - `@vendure/core` < 2.3.4 - `@vendure/core` >= 3.0.0, < 3.5.7 - `@vendure/core` >= 3.6.0, < 3.6.2 Note: versions 2.3.4

CVE: CVE-2026-40887

### Summary The `NativeAuthenticationStrategy.authenticate()` method is vulnerable to a timing attack that allows attackers to enumerate valid usernames (email addresses). ### Details In `packages/core/src/config/auth/native-authentication-strategy.ts`, the authenticate method returns immediately if a user is not found: ```typescript const user = await this.userService.getUserByEmailAddress(ctx, data.username); if (!user) { return false; // Instant return (~1-5ms) } const passwordMatch = await this.verifyUserPassword(ctx, user.id, data.password); // Password check takes ~200-400ms with b

CVE: CVE-2026-25050

### Impact Currently, in many Vendure deployments it's possible to select any currencyCode (really any, doesn't need to be assigned to the channel) and pay through Mollie and Stripe in that particular currencyCode. The prices are not transformed. The result is the Order is in Payment Settled in the foreign currency. See SS, CZK is not in the channel. I've tested with Mollie and Stripe it both works. **Further notes** After looking into this further and with help from the comments below, the root cause of this vulnerability is the ability to specify an arbitrary `currencyCode` as a query par

### Impact Vendure is an e-commerce GraphQL framework with a number of APIs and different levels of authorization. By default the Cookie settings are insecure, having the SameSite setting as false which results in not having one (originates from the cookie-session npm package’s default settings). ### Patches In progress ### Workarounds Manually set the `authOptions.cookieOptions.sameSite` configuration option to `'strict'`, `'lax'` or `true`. ### References _Are there any links users can visit to find out more?_