Information Exposure Through Timing Discrepancy in Shopware - CVE-2026-48011

Vulnerability details

The vulnerability allows a remote attacker to enumerate administrator usernames.

The vulnerability exists due to observable timing discrepancy in getUserEntityByUserCredentials() in src/Core/Framework/Api/OAuth/UserRepository.php when handling authentication requests to api/oauth/token. A remote attacker can send authentication requests and measure response times to enumerate administrator usernames.

The issue occurs because requests for nonexistent usernames return earlier than requests for existing usernames that reach password verification.

Affected software

How to mitigate CVE-2026-48011

External References

• https://github.com/shopware/shopware/security/advisories/GHSA-7w52-7jvm-m9vw
• https://github.com/shopware/shopware/blob/trunk/src/Core/Framework/Api/OAuth/UserRepository.php

Related Security Bulletins

• Multiple vulnerabilities in Shopware