GHSA-6J36-R6PR-59X4 Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification

External-authentication account takeover: external login linked to a pre-existing account by email without requiring verification Package: @vendure/core vendure-ecommerce/vendure, latest master · !IMPORTANT This vulnerability only affects deployments that use external / social authentication an...

PT-2026-94346

Name of the Vulnerable Software and Affected Versions Vendure versions prior to 3.7.0 Description An account takeover issue exists in the headless commerce platform where the ExternalAuthenticationService.createCustomerAndUser function links a new external authentication method to an existing use...