CVE-2026-31889

Shopware prior to versions 6.6.10.15 and 6.7.8.1 had a vulnerability in the app registration flow where the legacy HMAC‑based authentication did not sufficiently bind a shop installation to its domain. During re‑registration, the shop‑url could be updated without proving control of the previously...