GHSA-2w46-vq8h-98vh
Shopware 6's password recovery link does not expire after email change
GHSA-2w46-vq8h-98vh is a medium vulnerability (CVSS 5.0) in shopware/core, published November 14, 2025. No source lists public exploit code. Fixed in shopware/core 6.6.10.9.
- Severity
- 5.0 MediumCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
6.6.10.9shopware/core +3 more
Description
Summary
When a customer changes their email address after requesting a password reset, the old password reset link (tied to the previous email) remains valid. An attacker with access to the old email inbox is potentially able to reset the customer’s password even after the user changes their email address.
PoC
- Log in to a Shopware account.
- Request a password reset for your current email address.
- Copy the password reset link but do not open it.
- Log back into your account.n
- Navigate to Account Settings → Email and change your email address.
- Use the previously copied reset link (from before the email change).
- The system allows password change using the old link.
Impact
Reproduced on Stable 6.6.10.7 and trunk.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- Low
Affected packages
| Package | Affected | Fixed |
|---|---|---|
shopware/corePackagist | before 6.6.10.9 | 6.6.10.9 |
shopware/corePackagist | 6.7.0.0 up to 6.7.4.1 | 6.7.4.1 |
shopware/corePackagist | before 6.6.10.9, plus listed versions 6.3.0.06.3.0.16.3.0.26.3.1.06.3.1.1 Show 45 moreShow less6.3.2.06.3.2.16.3.3.06.3.3.16.3.4.06.3.4.16.3.5.06.3.5.16.3.5.26.3.5.36.3.5.46.4.0.06.4.0.0-RC16.4.1.06.4.1.16.4.1.26.4.10.06.4.10.16.4.11.06.4.11.16.4.12.06.4.13.06.4.14.06.4.15.06.4.15.16.4.15.26.4.16.06.4.16.16.4.17.06.4.17.16.4.17.26.4.18.06.4.18.16.4.19.06.4.2.06.4.2.16.4.20.06.4.20.16.4.20.26.4.3.06.4.3.16.4.4.06.4.4.16.4.5.06.4.5.1 | 6.6.10.9 |
shopware/corePackagist | 6.7.0.0 up to 6.7.4.1, plus listed versions v6.7.0.0v6.7.0.1v6.7.1.0v6.7.1.1v6.7.1.2 Show 6 moreShow lessv6.7.2.0v6.7.2.1v6.7.2.2v6.7.3.0v6.7.3.1v6.7.4.0 | 6.7.4.1 |
What each source reports
GitHub Advisories Score used
Shopware 6's password recovery link does not expire after email change
Summary
When a customer changes their email address after requesting a password reset, the old password reset link (tied to the previous email) remains valid. An attacker with access to the old email inbox is potentially able to reset the customer’s password even after the user changes their email address.
PoC
- Log in to a Shopware account.
- Request a password reset for your current email address.
- Copy the password reset link but do not open it.
- Log back into your account.n
- Navigate to Account Settings → Email and change your email address.
- Use the previously copied reset link (from before the email change).
- The system allows password change using the old link.
Impact
Reproduced on Stable 6.6.10.7 and trunk.
- Record
GHSA-2w46-vq8h-98vh- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:L - Weakness
- CWE-640
- Updated
- 2026-11-02
OSV
Shopware 6's password recovery link does not expire after email change
Summary
When a customer changes their email address after requesting a password reset, the old password reset link (tied to the previous email) remains valid. An attacker with access to the old email inbox is potentially able to reset the customer’s password even after the user changes their email address.
PoC
- Log in to a Shopware account.
- Request a password reset for your current email address.
- Copy the password reset link but do not open it.
- Log back into your account.n
- Navigate to Account Settings → Email and change your email address.
- Use the previously copied reset link (from before the email change).
- The system allows password change using the old link.
Impact
Reproduced on Stable 6.6.10.7 and trunk.
- Record
GHSA-2w46-vq8h-98vh- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:L - Weakness
- CWE-640
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/shopware/shopware/security/advisories/GHSA-2w46-vq8h-98vh
Left out here: 107 versions. The JSON record has them.