Shopware 6 has a vulnerability where password recovery links do not expire after a user changes their email address. An attacker with access to the old email inbox can use a previously issued password reset link to reset the password even after the email change. This issue affects versions prior to 6.6.10.9 and versions from 6.7.0.0 up to but not including 6.7.4.1. The vulnerability has been fixed in versions 6.6.10.9 and 6.7.4.1.