{"id":"CVE-2026-48011","aliases":["GHSA-7w52-7jvm-m9vw"],"url":"https://o3.security/vulnerability/CVE-2026-48011","summary":"Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames","details":"### Summary\nThere is a Proof of Concept which is able to enumerate the usernames of administrator users. This was possible by performing a timing attack.\n\n### Details\nThe faulty code exists in [`src/Core/Framework/Api/OAuth/UserRepository.php`](https://github.com/shopware/shopware/blob/trunk/src/Core/Framework/Api/OAuth/UserRepository.php):\n```\npublic function getUserEntityByUserCredentials(\n        string $username,\n        #[\\SensitiveParameter]\n        string $password,\n        string $grantType,\n        ClientEntityInterface $clientEntity\n    ): ?UserEntityInterface {\n        if ($this->loginConfigService->getConfig()?->useDefault === false) {\n            // never allow login via password if the default login is disabled (e.g. using SSO only)\n            return null;\n        }\n\n        $builder = $this->connection->createQueryBuilder();\n        $user = $builder->select('user.id', 'user.password')\n            ->from('user')\n            ->where('username = :username')\n            ->setParameter('username', $username)\n            ->fetchAssociative();\n\n        // PATH 1: EARLY RETURN WHEN USERNAME IS NOT FOUND\n        if (!$user) {\n            return null;\n        }\n\n        // PATH 2: VERIFY PASSWORD IF USER IS FOUND\n        if (!password_verify($password, (string) $user['password'])) {\n            return null;\n        }\n\n        return new User(Uuid::fromBytesToHex($user['id']));\n    }\n```\n\nSubroutine `getUserEntityByUserCredentials()` is called when an auth request is send to `api/oauth/token`. If the given username is not found an early return is done (PATH 1). Only if the user is found we verify the password using `password_verify`.\n\nPHP method `password_verify` by default uses hashing algorithm Argon2id which by design is intentionally 'slow' by introducing a timing cost to an attempt to bruteforce hashes more costly.\n\nSince `password_verify` has a notable executable time, PATH 2 where an user is found and verified will be slower on average then PATH 1 where we do an early return for non-existing users.\n\n### Proposed fix\nBefore doing the early return, `password_verify` a dummy hash.\n\n### Impact\n1. More targeted dictionary/bruteforce attacks.\n2. Spear phishing / eases social engineering.\n3. Credential stuffing from other data leaks.\n\n### Authors\nNiel Duysters (@NielDuysters) and Thomas Brankaer (@tbrankaer)","published":"2026-06-10T20:07:02.345Z","modified":"2026-08-12T03:51:12.951716871Z","cvss":{"score":3.7,"severity":"LOW","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},"epss":{"score":0.00223,"percentile":0.1305,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"shopware/platform","fixedVersion":"6.7.10.1"},{"ecosystem":"Packagist","name":"shopware/platform","fixedVersion":"6.6.10.18"},{"ecosystem":"Packagist","name":"shopware/core","fixedVersion":"6.7.10.1"},{"ecosystem":"Packagist","name":"shopware/core","fixedVersion":"6.6.10.18"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/shopware/shopware/releases/tag/v6.6.10.18"},{"type":"WEB","url":"https://github.com/shopware/shopware/releases/tag/v6.7.10.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48011.json"},{"type":"ADVISORY","url":"https://github.com/shopware/shopware/security/advisories/GHSA-7w52-7jvm-m9vw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48011"},{"type":"PACKAGE","url":"https://github.com/shopware/shopware"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:12.951716871Z"}}