CVE-2026-63472: Vendure External-Authentication Account Takeover

Executive Summary

Vendure, an open-source headless commerce platform, has patched a critical account-takeover vulnerability tracked as CVE-2026-63472 (CVSS 9.1). The bug lives in ExternalAuthenticationService.createCustomerAndUser(), part of the external-authentication helper in packages/core/src/service/helpers/external-authentication/external-authentication.service.ts.

When a new external (social/OAuth-style) login attempt presents an email address that already belongs to an existing customer, Vendure links the new external identity to that pre-existing account — selected purely by email-address match — without requiring config.verified === true. In deployments where a custom AuthenticationStrategy can forward an email the identity provider has not actually verified, an attacker can supply a victim's email address and get their own external identity bound to the victim's existing Vendure account.

The issue is fixed in Vendure 3.7.0 (GitHub advisory GHSA-6j36-r6pr-59x4).

Vulnerability Overview

Root Cause

The flaw is a classic "email_verified omission" bug — a pattern seen repeatedly in custom OAuth/SSO integrations that don't validate email ownership before trusting it as an identity key. The vulnerable code path selects an existing User record by emailAddress and attaches the newly presented ExternalAuthenticationMethod to it, skipping the check that should confirm the provider has actually verified the attacker controls that email address.

1. A store runs a custom external AuthenticationStrategy (social login,
   enterprise SSO, or similar) alongside the native email/password strategy
2. That strategy forwards an email address the identity provider itself
   has not verified belongs to the authenticating user
3. An attacker authenticates through the external strategy using a
   victim's known email address
4. ExternalAuthenticationService.createCustomerAndUser() finds the
   victim's existing account by email match and links the attacker's
   external identity to it — verified===true is never checked
5. The attacker can now sign in to the victim's account via their own
   external identity

Who Is Affected

This vulnerability only affects Vendure deployments that:

• Use an external/social AuthenticationStrategy in addition to the built-in native strategy, and
• That strategy is capable of returning an email address the provider has not verified the user owns (e.g., a custom OAuth integration that trusts an unverified email claim)

Not affected:

• Native-only email + password deployments
• External strategies that always require provider-verified email ownership before authenticating
• New-account creation for a previously unused email address (this flow is unaffected)

Impact

Where exploitable, an attacker can:

• Sign in as the victim and access their orders, addresses, and personal information
• Place orders or make account changes as the victim
• Potentially pivot from account takeover into further fraud (stored payment flows, loyalty balances, etc., depending on the store's configuration)

Remediation

1. Upgrade @vendure/core to 3.7.0 or later
2. If you run a custom external AuthenticationStrategy, audit it to confirm it only forwards provider-verified email addresses, and reject authentication attempts where email ownership can't be confirmed
3. Review recent account-linking activity for unexpected external-identity bindings on high-value accounts if you cannot patch immediately

References

• NVD — CVE-2026-63472
• GitLab Advisory Database — CVE-2026-63472
• GitHub Security Advisory GHSA-6j36-r6pr-59x4