Vendure versions prior to 3.7.0 contain an improper authentication vulnerability (CWE-287) in the ExternalAuthenticationService.createCustomerAndUser function. This function selects an existing customer user by email address and attaches a new external authentication method without requiring the email ownership to be verified. In deployments using a custom external AuthenticationStrategy that does not verify email ownership, an attacker can authenticate using a victim's email and bind their external identity to the victim's account. This allows exposure of sensitive information and unauthorized account actions. Native email/password deployments and external strategies that enforce verified email ownership are not affected. The issue is resolved in version 3.7.0.

An attacker can gain unauthorized access to a victim's account by binding their external identity to the victim's existing account without verified email ownership. This can expose sensitive personal information such as orders and addresses and allow the attacker to perform account changes or place orders as the victim. The vulnerability does not affect native email/password deployments or external authentication strategies that require verified email ownership. The CVSS v3.1 score is 9.1, indicating a critical severity with high confidentiality and integrity impact but no availability impact.

Upgrade Vendure to version 3.7.0 or later, where this vulnerability is fixed. Deployments using native email and password authentication or external authentication strategies that enforce verified email ownership are not affected. If upgrading immediately is not possible, ensure that any custom external AuthenticationStrategy verifies email ownership before attaching external authentication methods to existing accounts.