This vulnerability involves missing authentication for a critical function in the checkout session lookup handler (src/app/api/stripe/checkout_sessions/route.ts) of MarcosCamara01 Ecommerce Template before commit 91e273c. The GET handler at /api/stripe/checkout_sessions retrieves the full Stripe Checkout Session object by calling stripe.checkout.sessions.retrieve() without verifying that the requester is authenticated or owns the session. Because the session ID is exposed in the buyer's browser URL after payment, an unauthenticated remote attacker who obtains a valid session ID can access sensitive buyer data such as name, email, phone, billing address, amount paid, and internal userId. This contrasts with sibling endpoints like POST /api/stripe/payment, which enforce authentication. The lack of access control on this endpoint leads to unauthorized disclosure of personal data.

An unauthenticated remote attacker who obtains a valid Stripe Checkout Session ID can retrieve sensitive personal and payment information of buyers, including name, email, phone number, billing address, amount paid, and internal userId. This exposure results from the absence of authentication and authorization checks on the affected endpoint. The session ID's presence in the browser URL after payment increases the risk of leakage through Referer headers, analytics tools, server logs, and shared browser histories, potentially allowing attackers to harvest multiple users' personal data without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the GET /api/stripe/checkout_sessions endpoint by implementing proper authentication and authorization checks to ensure that only the session owner can retrieve their checkout session data. Avoid exposing the session ID in URLs accessible to third parties, such as in query parameters, to reduce leakage risk.