3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-48011

CVE-2026-48011: Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames

Shopware is an open commerce platform. Prior to versions 6.6.10.18 and 6.7.10.1, an attacker is able to enumerate the usernames of administrator users by performing a timing attack. Versions 6.6.10.18 and 6.7.10.1 fix the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-48011

CVE-2026-48011:

3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
shopware/platform	composer	>= 6.7.0.0, < 6.7.10.1	6.7.10.1
shopware/platform	composer	< 6.6.10.18	6.6.10.18
shopware/core	composer	>= 6.7.0.0, < 6.7.10.1	6.7.10.1
shopware/core	composer	< 6.6.10.18	6.6.10.18

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-7w52-7jvm-m9vw, is a timing attack that allows for the enumeration of administrator usernames and client IDs in Shopware. The root cause lies in how authentication requests are handled. When a request is made with a username or client ID, the system's response time differs depending on whether the entity exists.

Specifically, in the Shopware\Core\Framework\Api\OAuth\UserRepository::getUserEntityByUserCredentials function, if a username does not exist, the function returns immediately. However, if the username is valid, the function proceeds to call PHP's password_verify function, which is computationally intensive by design to prevent brute-force attacks. This measurable difference in execution time between a failed and successful username lookup allows an attacker to determine which usernames are registered in the system.

The same flaw was identified in the Shopware\Core\Framework\Api\OAuth\ClientRepository for client ID validation in the validateClient and getClientEntity methods.

The security patch mitigates this vulnerability by removing the early return. Instead, if a user or client is not found, the code now creates dummy data and proceeds to call password_verify with values guaranteed to fail. This ensures that the execution time is consistent, whether the provided credential is valid or not, thus neutralizing the timing attack vector.

Vulnerable functions

Shopware\Core\Framework\Api\OAuth\UserRepository::getUserEntityByUserCredentials

src/Core/Framework/Api/OAuth/UserRepository.php

The function returns early if a user is not found, but performs a costly password verification if the user exists. This time difference creates a timing attack vulnerability that allows an attacker to enumerate valid usernames. The patch mitigates this by ensuring `password_verify` is always called, even for non-existent users, by using a dummy hash.

Shopware\Core\Framework\Api\OAuth\ClientRepository::validateClient

src/Core/Framework/Api/OAuth/ClientRepository.php

Similar to the user enumeration vulnerability, this function returns early if a client ID is not found. If the client exists, it proceeds to verify the client secret. This timing discrepancy allows for the enumeration of valid client identifiers. The fix ensures `password_verify` is always executed.

Shopware\Core\Framework\Api\OAuth\ClientRepository::getClientEntity

src/Core/Framework/Api/OAuth/ClientRepository.php

This function also has an early-return path when a client is not found based on its identifier. This can be exploited in a timing attack. The patch adds a call to `password_verify` with dummy values to make the execution time consistent, regardless of whether the client exists.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.