The vulnerability lies in the Express Checkout feature of the PrestaShop Checkout module. The root cause is improper authentication in the PsCheckout\Infrastructure\Action\CustomerAuthenticationAction::execute method. When a user performs an express checkout, this method checks if an account already exists with the provided email address. If it does, it logs the user into that account without requiring a password, leading to a critical account takeover vulnerability. The patch addresses this by completely removing the vulnerable logic from CustomerAuthenticationAction::execute and changing the calling function, PsCheckout\Core\Customer\Action\ExpressCheckoutAction::execute, to create a new guest account instead of attempting to log in an existing user. Additional validation was also added in the ps_checkoutExpressCheckoutModuleFrontController::postProcess method to ensure the PayPal order ID is associated with the current cart, providing an extra layer of security.