CVE-2026-63472 | vendurehq Vendure up to 3.6.x External Authentication external-authentication.service.ts emailAddress/verified improper authentication

A vulnerability, which was classified as critical, has been found in vendurehq Vendure up to 3.6.x. This affects the function ExternalAuthenticationService.createCustomerAndUser of the file packages/core/src/service/helpers/external-authentication/external-authentication.service.ts of the component External Authentication. Performing a manipulation of the argument emailAddress/verified results in improper authentication.

This vulnerability is identified as CVE-2026-63472. The attack can be initiated remotely. There is not any exploit available.

It is advisable to upgrade the affected component.VulDB Recent EntriesRead More