{ "document": { "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "National Cyber Security Centre", "namespace": "https://www.ncsc.nl/" }, "title": "CVE-2026-31889", "tracking": { "current_release_date": "2026-03-23T01:37:52.372493Z", "generator": { "date": "2026-02-17T15:00:00Z", "engine": { "name": "V.E.L.M.A", "version": "1.7" } }, "id": "CVE-2026-31889", "initial_release_date": "2026-03-11T19:39:00.342845Z", "revision_history": [ { "date": "2026-03-11T19:39:00.342845Z", "number": "1", "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (4).| References created (1).| CWES updated (1)." }, { "date": "2026-03-11T19:39:02.639341Z", "number": "2", "summary": "NCSC Score created." }, { "date": "2026-03-11T20:00:44.907903Z", "number": "3", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (2).| CWES updated (1)." }, { "date": "2026-03-11T20:00:47.257921Z", "number": "4", "summary": "NCSC Score updated." }, { "date": "2026-03-11T20:26:19.790168Z", "number": "5", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (1).| CWES updated (1)." }, { "date": "2026-03-11T20:26:27.474143Z", "number": "6", "summary": "NCSC Score updated." }, { "date": "2026-03-11T21:56:44.047851Z", "number": "7", "summary": "References created (1)." }, { "date": "2026-03-12T14:57:30.454734Z", "number": "8", "summary": "Source created.| CVE status created. (valid)| EPSS created." }, { "date": "2026-03-12T14:57:31.832496Z", "number": "9", "summary": "NCSC Score updated." }, { "date": "2026-03-12T20:38:49.604010Z", "number": "10", "summary": "Unknown change." }, { "date": "2026-03-16T20:25:03.662781Z", "number": "11", "summary": "Products created (2).| Product Identifiers created (2)." }, { "date": "2026-03-16T20:25:12.998888Z", "number": "12", "summary": "NCSC Score updated." }, { "date": "2026-03-19T15:30:40.260989Z", "number": "13", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (3).| CWES updated (1)." }, { "date": "2026-03-20T09:32:23.330498Z", "number": "14", "summary": "Source connected.| CVE status created. (valid)| EPSS created." } ], "status": "interim", "version": "14" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/<6.6.10.15", "product": { "name": "vers:unknown/<6.6.10.15", "product_id": "CSAFPID-5798757" } }, { "category": "product_version_range", "name": "vers:unknown/>=6.7.0.0|<6.7.8.1", "product": { "name": "vers:unknown/>=6.7.0.0|<6.7.8.1", "product_id": "CSAFPID-5798756" } } ], "category": "product_name", "name": "core" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/<6.6.10.15", "product": { "name": "vers:unknown/<6.6.10.15", "product_id": "CSAFPID-5798759" } }, { "category": "product_version_range", "name": "vers:unknown/>=6.7.0.0|<6.7.8.1", "product": { "name": "vers:unknown/>=6.7.0.0|<6.7.8.1", "product_id": "CSAFPID-5798758" } } ], "category": "product_name", "name": "platform" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/<6.6.10.15", "product": { "name": "vers:unknown/<6.6.10.15", "product_id": "CSAFPID-5830366", "product_identification_helper": { "cpe": "cpe:2.3:a:shopware:shopware:*:*:*:*:*:*:*:*" } } }, { "category": "product_version_range", "name": "vers:unknown/>=6.7.0.0|<6.7.8.1", "product": { "name": "vers:unknown/>=6.7.0.0|<6.7.8.1", "product_id": "CSAFPID-5830367", "product_identification_helper": { "cpe": "cpe:2.3:a:shopware:shopware:*:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "shopware" } ], "category": "vendor", "name": "shopware" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-31889", "cwe": { "id": "CWE-290", "name": "Authentication Bypass by Spoofing" }, "notes": [ { "category": "description", "text": "Shopware is an open commerce platform. Prior to 6.6.10.15 and 6.7.8.1, a vulnerability in the Shopware app registration flow that could, under specific conditions, allow attackers to take over the communication channel between a shop and an app. The legacy app registration flow used HMAC‑based authentication without sufficiently binding a shop installation to its original domain. During re‑registration, the shop-url could be updated without proving control over the previously registered shop or domain. This made targeted hijacking of app communication feasible if an attacker possessed the relevant app‑side secret. By abusing app re‑registration, an attacker could redirect app traffic to an attacker‑controlled domain and potentially obtain API credentials intended for the legitimate shop. This vulnerability is fixed in 6.6.10.15 and 6.7.8.1.", "title": "cveprojectv5 - https://www.cve.org/CVERecord?id=CVE-2026-31889" }, { "category": "description", "text": "### Summary\n\nWe identified and fixed a vulnerability in the Shopware app registration flow that could, under specific conditions, allow attackers to take over the communication channel between a shop and an app. By abusing app re‑registration, an attacker could redirect app traffic to an attacker‑controlled domain and potentially obtain API credentials intended for the legitimate shop.\nWe have no evidence that this vulnerability has been exploited.\n\n---\n\n### Affected Scope\n\n- All apps (public and private) that use a `registrationUrl` in their app manifest and rely on the legacy HMAC‑based registration flow.\n- Both on‑premise and cloud installations are affected until updated to a fixed Shopware version or protected by the latest Shopware Security Plugin.\n- Shopware services and first‑party apps using the affected SDKs were reviewed and patched.\nThe vulnerability does not affect core storefront or administration authentication; it is limited to the app system’s registration and re‑registration mechanism.\n\n---\n\n### Impact\n\nIn a successful attack, an attacker who already knows certain app‑side secrets could:\n- Re‑register an existing app installation with a domain under their control.\n- Intercept App → Shop communication and cause data tampering (“data poisoning”).\n- Obtain API integration credentials of the shop with the permissions granted to the app.\nShop owners and app manufacturers would typically observe this as “app malfunction” rather than an obvious security issue, which increases the need for hardening.\n\n---\n\n### Root Cause\n\nThe legacy app registration flow used HMAC‑based authentication without sufficiently binding a shop installation to its original domain. During re‑registration, the `shop-url` could be updated without proving control over the previously registered shop or domain. This made targeted hijacking of app communication feasible if an attacker possessed the relevant app‑side secret.\n\n---\n\n### Fix\n\nWe have hardened the app registration and re‑registration process:\n- **Dual signature requirement:** Re‑registration now requires both the app secret and the existing shop secret to be presented and validated.\n- **Mandatory secret rotation:** On successful re‑registration, a new shop secret is generated and verified; the previous secret is invalidated after a short grace period.\n- **Stricter validation:** Shopware only accepts updated shop URLs and secrets once the full confirmation flow has completed successfully.\n- **Improved logging and monitoring:** All re‑registrations are now logged with additional metadata to help detect abuse patterns.\nThese changes are delivered via:\n- Updated Shopware core releases (6.6.x, 6.7.x), and\n- Updated versions of the Shopware Security Plugin for supported older versions,\n- Updated official SDKs (e.g. PHP and JavaScript app SDKs).\n---\n\n### Required Action\n\n#### For Merchants / Shop Operators\n\n1. **Update Shopware**\n - Upgrade to the latest Shopware 6.6.x / 6.7.x release that includes this fix, **or**\n - Install/update the latest Shopware Security Plugin version providing the hotfix for your Shopware 6 installation.\n2. **Update apps**\n - Ensure all installed apps are updated to the latest versions provided by their manufacturers.\n - If you suspect compromised keys or observe unexpected app behaviour, re‑install the affected app or trigger key rotation as documented by the app vendor.\n\n#### For App Manufacturers / Partners\n\n1. **Update SDKs / implementations**\n - Update to the latest Shopware app SDKs (PHP / JS) or apply the documented changes if you maintain a custom implementation of the registration flow.\n - Validate **both** `shopware-app-signature` and `shopware-shop-signature` for re‑registration requests.\n - Always generate and store a new shop secret on re‑registration and only switch to it after a successful confirmation.\n2. **Review your apps**\n - Verify that your app does not blindly accept changed `shop-url` values without validating signatures.\n - Check any logic that exposes data or functionality based solely on HMAC signatures from shops and ensure it aligns with the hardened registration model.\n3. **Test your implementation**\n - Use the updated tooling and guidance provided in your Shopware Account / partner channels to validate that your registration flow complies with the new requirements.", "title": "github - https://github.com/advisories/GHSA-c4p7-rwrg-pf6p" }, { "category": "description", "text": "Shopware is an open commerce platform. Prior to 6.6.10.15 and 6.7.8.1, a vulnerability in the Shopware app registration flow that could, under specific conditions, allow attackers to take over the communication channel between a shop and an app. The legacy app registration flow used HMAC‑based authentication without sufficiently binding a shop installation to its original domain. During re‑registration, the shop-url could be updated without proving control over the previously registered shop or domain. This made targeted hijacking of app communication feasible if an attacker possessed the relevant app‑side secret. By abusing app re‑registration, an attacker could redirect app traffic to an attacker‑controlled domain and potentially obtain API credentials intended for the legitimate shop. This vulnerability is fixed in 6.6.10.15 and 6.7.8.1.", "title": "nvd - https://nvd.nist.gov/vuln/detail/CVE-2026-31889" }, { "category": "description", "text": "### Summary\n\nWe identified and fixed a vulnerability in the Shopware app registration flow that could, under specific conditions, allow attackers to take over the communication channel between a shop and an app. By abusing app re‑registration, an attacker could redirect app traffic to an attacker‑controlled domain and potentially obtain API credentials intended for the legitimate shop.\nWe have no evidence that this vulnerability has been exploited.\n\n---\n\n### Affected Scope\n\n- All apps (public and private) that use a `registrationUrl` in their app manifest and rely on the legacy HMAC‑based registration flow.\n- Both on‑premise and cloud installations are affected until updated to a fixed Shopware version or protected by the latest Shopware Security Plugin.\n- Shopware services and first‑party apps using the affected SDKs were reviewed and patched.\nThe vulnerability does not affect core storefront or administration authentication; it is limited to the app system’s registration and re‑registration mechanism.\n\n---\n\n### Impact\n\nIn a successful attack, an attacker who already knows certain app‑side secrets could:\n- Re‑register an existing app installation with a domain under their control.\n- Intercept App → Shop communication and cause data tampering (“data poisoning”).\n- Obtain API integration credentials of the shop with the permissions granted to the app.\nShop owners and app manufacturers would typically observe this as “app malfunction” rather than an obvious security issue, which increases the need for hardening.\n\n---\n\n### Root Cause\n\nThe legacy app registration flow used HMAC‑based authentication without sufficiently binding a shop installation to its original domain. During re‑registration, the `shop-url` could be updated without proving control over the previously registered shop or domain. This made targeted hijacking of app communication feasible if an attacker possessed the relevant app‑side secret.\n\n---\n\n### Fix\n\nWe have hardened the app registration and re‑registration process:\n- **Dual signature requirement:** Re‑registration now requires both the app secret and the existing shop secret to be presented and validated.\n- **Mandatory secret rotation:** On successful re‑registration, a new shop secret is generated and verified; the previous secret is invalidated after a short grace period.\n- **Stricter validation:** Shopware only accepts updated shop URLs and secrets once the full confirmation flow has completed successfully.\n- **Improved logging and monitoring:** All re‑registrations are now logged with additional metadata to help detect abuse patterns.\nThese changes are delivered via:\n- Updated Shopware core releases (6.6.x, 6.7.x), and\n- Updated versions of the Shopware Security Plugin for supported older versions,\n- Updated official SDKs (e.g. PHP and JavaScript app SDKs).\n---\n\n### Required Action\n\n#### For Merchants / Shop Operators\n\n1. **Update Shopware**\n - Upgrade to the latest Shopware 6.6.x / 6.7.x release that includes this fix, **or**\n - Install/update the latest Shopware Security Plugin version providing the hotfix for your Shopware 6 installation.\n2. **Update apps**\n - Ensure all installed apps are updated to the latest versions provided by their manufacturers.\n - If you suspect compromised keys or observe unexpected app behaviour, re‑install the affected app or trigger key rotation as documented by the app vendor.\n\n#### For App Manufacturers / Partners\n\n1. **Update SDKs / implementations**\n - Update to the latest Shopware app SDKs (PHP / JS) or apply the documented changes if you maintain a custom implementation of the registration flow.\n - Validate **both** `shopware-app-signature` and `shopware-shop-signature` for re‑registration requests.\n - Always generate and store a new shop secret on re‑registration and only switch to it after a successful confirmation.\n2. **Review your apps**\n - Verify that your app does not blindly accept changed `shop-url` values without validating signatures.\n - Check any logic that exposes data or functionality based solely on HMAC signatures from shops and ensure it aligns with the hardened registration model.\n3. **Test your implementation**\n - Use the updated tooling and guidance provided in your Shopware Account / partner channels to validate that your registration flow complies with the new requirements.", "title": "github - https://api.github.com/advisories/GHSA-c4p7-rwrg-pf6p" }, { "category": "other", "text": "0.00082", "title": "EPSS" }, { "category": "other", "text": "4.8", "title": "NCSC Score" }, { "category": "other", "text": "Is related to (a version of) an uncommon product", "title": "NCSC Score top increasing factors" }, { "category": "other", "text": "The value of the most recent EPSS score", "title": "NCSC Score top decreasing factors" } ], "product_status": { "known_affected": [ "CSAFPID-5798756", "CSAFPID-5798757", "CSAFPID-5798758", "CSAFPID-5798759", "CSAFPID-5830366", "CSAFPID-5830367" ] }, "references": [ { "category": "external", "summary": "Source - cveprojectv5", "url": "https://www.cve.org/CVERecord?id=CVE-2026-31889" }, { "category": "external", "summary": "Source raw - cveprojectv5", "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/31xxx/CVE-2026-31889.json" }, { "category": "external", "summary": "Source - github", "url": "https://github.com/advisories/GHSA-c4p7-rwrg-pf6p" }, { "category": "external", "summary": "Source raw - github", "url": "https://api.github.com/advisories/GHSA-c4p7-rwrg-pf6p" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31889" }, { "category": "external", "summary": "Source raw - nvd", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-31889" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-31889" }, { "category": "external", "summary": "Source raw - first", "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0" }, { "category": "external", "summary": "Source - github", "url": "https://api.github.com/advisories/GHSA-c4p7-rwrg-pf6p" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd", "url": "https://github.com/shopware/shopware/security/advisories/GHSA-c4p7-rwrg-pf6p" }, { "category": "external", "summary": "Reference - github", "url": "https://github.com/advisories/GHSA-c4p7-rwrg-pf6p" }, { "category": "external", "summary": "Reference - github", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31889" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L", "baseScore": 8.9, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-5798756", "CSAFPID-5798757", "CSAFPID-5798758", "CSAFPID-5798759", "CSAFPID-5830366", "CSAFPID-5830367" ] } ], "title": "CVE-2026-31889" } ] }