CVE-2026-48012: 
PHP vulnerability analysis and mitigation

CVE-2026-48012 is an open redirect vulnerability (CWE-601) in Shopware's public SSO entry point at GET /api/oauth/sso/auth, where the application blindly trusts the Referer request header as a fallback redirect destination when no valid SSO session state is present. Affected packages are shopware/core and shopware/platform versions >= 6.7.3.0 and < 6.7.10.1. The vulnerability was privately reported on May 19, 2026, and published to the GitHub Advisory Database on June 4, 2026. It carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory, Shopware Advisory).

The root cause (CWE-601) is that the GET /api/oauth/sso/auth endpoint, when it cannot locate the expected SSO session state, falls back to the HTTP Referer header as the redirect destination without any validation — no same-origin check, no relative-path requirement, and no scheme filtering. An unauthenticated attacker can craft a request with an arbitrary Referer header value (including javascript: URIs) and the server will emit an HTTP 302 response with a user-controlled Location header, as well as a matching <meta refresh> tag and redirect anchor in the HTML body. A Python PoC (poc_sso_referer_open_redirect.py) was included in the original report, demonstrating three cases: no Referer (returns 401), an external HTTPS URL (returns 302 to attacker-controlled site), and javascript:alert(1) (returns 302 with the dangerous scheme reflected verbatim) (GitHub Advisory, Shopware Advisory).

The primary impact is integrity loss: an unauthenticated attacker can weaponize a trusted Shopware OAuth endpoint (/api/oauth/sso/auth) to redirect users to arbitrary external destinations, enabling phishing, brand impersonation, and redirect chaining. Because the redirect originates from an OAuth/SSO path, it carries implicit trust that increases the likelihood of users or automated clients following it. The acceptance of javascript: URIs in the Location header and HTML body elevates the risk beyond a standard open redirect, potentially enabling client-side script execution in browsers or HTTP clients that process such schemes. There is no direct confidentiality or availability impact (GitHub Advisory).

1. Reconnaissance: Identify a Shopware instance running shopware/core or shopware/platform versions >= 6.7.3.0 and < 6.7.10.1 that exposes the SSO endpoint at /api/oauth/sso/auth.
2. Craft malicious request: Prepare a GET request to https://<target>/api/oauth/sso/auth with a Referer header set to the desired redirect destination (e.g., Referer: https://attacker.example/phishing-page).
3. Send unauthenticated request: Submit the request without any session cookies or authentication tokens. The server, finding no valid SSO session state, falls back to the Referer header value.
4. Observe redirect response: The server returns HTTP 302 with Location: https://attacker.example/phishing-page and an HTML body containing a <meta http-equiv="refresh"> tag and anchor link pointing to the same attacker-controlled URL.
5. Deliver to victim: Craft a link to https://<trusted-shopware-domain>/api/oauth/sso/auth and distribute it to targets (e.g., via email). When a victim clicks the link, their browser follows the 302 redirect to the attacker's site, with the redirect appearing to originate from the legitimate Shopware OAuth endpoint.
6. Optional — dangerous scheme abuse: Replace the Referer value with javascript:alert(1) (or a more harmful payload) to test whether the client or intermediary processes the javascript: URI reflected in Location and the HTML body (GitHub Advisory, Shopware Advisory).

• Network: Unusual GET requests to /api/oauth/sso/auth without accompanying SSO session cookies or state parameters, particularly from unfamiliar source IPs or automated tools; HTTP 302 responses from this endpoint with Location headers pointing to external or non-Shopware domains.
• Logs: Web server or application access logs showing repeated unauthenticated requests to /api/oauth/sso/auth with varying Referer header values; 302 responses to external URLs or javascript: URIs logged for this endpoint.
• Network: Outbound redirect chains originating from the Shopware server's OAuth path to external domains not associated with configured SSO identity providers.

Shopware has released version 6.7.10.1 as a security patch for both shopware/core and shopware/platform, which addresses this vulnerability along with several other critical issues. Operators should upgrade to 6.7.10.1 immediately. As a temporary workaround prior to patching, network-level controls (e.g., WAF rules) can be configured to block or sanitize requests to /api/oauth/sso/auth that contain external URLs or non-HTTP schemes in the Referer header. The advisory also recommends that the endpoint be modified to return a fixed error response or redirect only to a hardcoded internal page when SSO state is absent, rather than trusting any request header (Shopware Release, GitHub Advisory).