CVE-2026-31889

Shopware prior to versions 6.6.10.15 and 6.7.8.1 had a vulnerability in the app registration flow where the legacy HMAC‑based authentication did not sufficiently bind a shop installation to its domain. During re‑registration, the shop‑url could be updated without proving control of the previously...

CVE-2026-31889 Shopware has a potential take over of app credentials

Shopware is an open commerce platform. Prior to 6.6.10.15 and 6.7.8.1, a vulnerability in the Shopware app registration flow that could, under specific conditions, allow attackers to take over the communication channel between a shop and an app. The legacy app registration flow used HMAC‑based...