GHSA-2w46-vq8h-98vh: Shopware 6's password recovery link does not expire after email change
When a customer changes their email address after requesting a password reset, the old password reset link (tied to the previous email) remains valid. An attacker with access to the old email inbox is potentially able to reset the customer’s password even after the user changes their email address.
References
- github.com/advisories/GHSA-2w46-vq8h-98vh
- github.com/shopware/shopware
- github.com/shopware/shopware/commit/1338dd9a11e361639704bf8f09b6878552eb8c13
- github.com/shopware/shopware/commit/2fb94855696a90045b81c503d216ba7df8e64e52
- github.com/shopware/shopware/releases/tag/v6.6.10.9
- github.com/shopware/shopware/releases/tag/v6.7.0.0
- github.com/shopware/shopware/releases/tag/v6.7.4.1
- github.com/shopware/shopware/security/advisories/GHSA-2w46-vq8h-98vh
Code Behaviors & Features
Detect and mitigate GHSA-2w46-vq8h-98vh with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →