High · published December 11, 2025
⚡ A crafty slice of code can sneak in through the login page! This Reflected XSS vulnerability in Shopware’s AuthController.php lets attackers inject nasty code via a simple URL parameter. 🔥 Think of the login page like a restaurant menu. If someone can slip an extra item onto the menu without the chef checking, they can serve up anything they want — delicious or disastrous! An attacker could manipulate the URL and execute arbitrary JavaScript in the context of the user's browser, potentially stealing session cookies or redirecting users to malicious sites. This could lead to data theft or account compromise, making it a surprisingly sneaky vulnerability that threatens your storefront's security!
Think of the login page like a restaurant menu. If someone can slip an extra item onto the menu without the chef checking, they can serve up anything they want — delicious or disastrous! The vulnerability arises because the 'waitTime' request parameter is rendered directly in the Twig template without any validation, allowing direct code injection. This enables attackers to craft URLs that execute unwanted scripts when users visit the login page.
An attacker could manipulate the URL and execute arbitrary JavaScript in the context of the user's browser, potentially stealing session cookies or redirecting users to malicious sites. This could lead to data theft or account compromise, making it a surprisingly sneaky vulnerability that threatens your storefront's security! To protect your storefront, patch immediately to versions 6.6.10.10 or 6.7.5.1. Ensure that all input parameters, including those in URLs, are validated and sanitized before being rendered. Regularly audit your templates for similar vulnerabilities! You've got this! Follow these steps and you'll have your Shopware storefront locked down tight in no time. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| shopware/shopware | ≥ 6.4.6.0, < 6.6.10.10 | 6.6.10.10 |
| shopware/shopware | ≥ 6.7.0.0, < 6.7.5.1 | 6.7.5.1 |