CVE-2026-48012 shopware vulnerability
Shopware is an open commerce platform. Versions 6.7.3.0 through 6.7.10.0 have an open redirect in Shopware's public SSO entry point at `GET /api/oauth/sso/auth`. When the endpoint is reached without the expected SSO session state, the application falls back to the request's `Referer` header and uses that value as the redirect destination. In the validated behavior, the server does not restrict that fallback target to same-origin URLs, does not require a relative path, and does not reject dangerous schemes such as `javascript:`. As a result, an unauthenticated request can turn this endpoint into a reusable redirect primitive whose destination is fully controlled by attacker-supplied request metadata. The security problem is not limited to a harmless navigation mismatch. The endpoint sits under `/api/oauth/`, which gives the redirect a trustworthy application-controlled origin and makes it suitable for phishing chains, branded redirect abuse, and cases where client software automatically follows redirects issued by a trusted host. The attached evidence also shows that the response is not only an HTTP `302` with a user-controlled `Location` header. The HTML body contains a matching meta refresh tag and redirect link built from the same attacker-controlled value. In the validated proof, the endpoint redirects to `https://attacker.example/poc` when that URL is supplied through `Referer`, and it also reflects `javascript:alert(1)` into `Location` and the HTML redirect body without any scheme filtering. This report therefore stays conservative and claims an open redirect with arbitrary redirect targets, while noting that the lack of scheme restrictions makes the behavior materially worse than a same-scheme external redirect. Version 6.7.10.1 fixes the issue.
Browse API Security security risksQuick answer
shopware should be reviewed and updated if it matches the affected versions. The recommended fix is to apply the vendor-supported patched version or the mitigation steps below, then retest the public website with Fixnx.
Who is affected
Affected versions
- >= 6.7.3.0, < 6.7.10.1
Fixed versions
- Apply the latest vendor-supported patched version.
How to fix it
CVE-2026-48012 affects shopware and involves open redirect. An attacker may redirect users from a trusted login flow to an untrusted destination. Treat this as a high-priority fix, especially when the affected component or endpoint is reachable by untrusted users. Upgrade shopware to 6.7.10.1 or a later vendor-supported fixed release.
- Inventory every deployment, device, package, plugin, container, build, and environment that uses shopware.
- Compare the installed version with the recorded affected range: >= 6.7.3.0, < 6.7.10.1.
- Upgrade shopware to 6.7.10.1 or a later vendor-supported fixed release.
- Until patched, allow only exact local redirect destinations and block user-controlled external hosts in redirect or email-link parameters.
- Review configuration, roles, tokens, network paths, and exposed endpoints connected to shopware; remove access that is not required.
- Review authentication, email, redirect, and web logs for external destinations, token-bearing links, and unexpected post-login navigation.
- If exploitation is suspected, isolate affected assets, preserve evidence, rotate exposed credentials or keys, restore trusted data, and rebuild compromised systems before returning them to service.
Scan now. Google sign-in is only needed to unlock fix guidance.
Verify the fix
- Confirm every affected asset now runs the fixed vendor-supported release or has the documented mitigation for CVE-2026-48012 in place.
- Use a safe regression test to confirm the affected open redirect path no longer produces the vulnerable behavior.
- Confirm temporary access controls, endpoint restrictions, network blocks, and least-privilege settings remain effective after the update.
- Review post-remediation logs and rerun Fixnx plus the relevant package, dependency, firmware, browser, or product-specific security check.
- Document affected assets, versions, changes, validation evidence, reviewed logs, and any credential rotation, cleanup, or replacement completed.
Related categories
Related security risks
More published guidance from the same primary category.
Trusted references
FAQ
What is affected by CVE-2026-48012?
shopware versions listed as affected should be reviewed: >= 6.7.3.0, < 6.7.10.1.
What should I fix first?
Start with internet-facing sites, admin panels, login flows, plugins, themes, modules, packages, and systems that process user-controlled input or sensitive data.
How do I confirm the fix worked?
Apply the patched version or mitigation, clear caches where relevant, retest the affected workflow, and run a new Fixnx scan to verify public website exposure signals.
How are Fixnx security risk categories chosen?
Fixnx keeps one canonical risk page and assigns only broad, relevant categories such as ecosystem, technology area, or vulnerability class.