Account Takeover Vulnerability in Vendure External Authentication

Vendure versions prior to 3.7.0 contain a critical vulnerability in the ExternalAuthenticationService that enables account takeover. The flaw exists in the createCustomerAndUser method, which links external OAuth or SSO authentication identities to existing customer accounts based solely on an email address match. Crucially, the system does not enforce that the provided email address is verified by the external identity provider.

In deployments using custom AuthenticationStrategy implementations - specifically those that fail to validate the email_verified claim or improperly handle unverified email addresses - an attacker can register an account on an external provider using a victim's email address. When this attacker authenticates against the vulnerable Vendure instance, the application incorrectly binds the attacker's external identity to the pre-existing account belonging to the victim. This results in the attacker gaining full access to the victim's account, including PII, order history, and the ability to perform unauthorized transactions.

Attack Chain

1. Attacker identifies a Vendure instance configured with an external AuthenticationStrategy that does not enforce strict email verification.
2. Attacker creates an account on the external OIDC or OAuth provider using the target victim's email address (victim@example.com).
3. The external provider, not requiring rigorous verification, allows the registration.
4. Attacker initiates the authentication flow on the Vendure store using the external provider.
5. The external provider passes the email address victim@example.com to the Vendure ExternalAuthenticationService.
6. createCustomerAndUser identifies a pre-existing user account associated with victim@example.com.
7. The system silently links the attacker's ExternalAuthenticationMethod to the victim's account without checking the verified status.
8. Attacker logs in using the linked external provider and gains full access to the victim's account.

Impact

Successful exploitation leads to full account takeover, allowing attackers to read or modify victim PII, view private order histories, update shipping addresses, and place unauthorized orders on the victim's behalf. This vulnerability affects any Vendure deployment that utilizes external authentication strategies that accept unverified email claims.

Recommendation

1. Upgrade all Vendure instances to version 3.7.0 or later immediately to address CVE-2026-63472.
2. Audit all custom AuthenticationStrategy implementations to ensure they only set verified: true when the external identity provider has explicitly verified the email address ownership.
3. Implement logic within custom AuthenticationStrategy code to prevent silent linking of unverified external identities to existing accounts; require active user authentication or session verification before linking new external providers.