CVE-2026-48011: Shopware Timing-attack On Admin Panel Allowing Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-7w52-7jvm-m9vw",
  "modified" : "2026-06-11T14:06:35Z",
  "published" : "2026-06-04T19:31:17Z",
  "aliases" : [ "CVE-2026-48011" ],
  "summary" : "Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames",
  "details" : "### Summary\nThere is a Proof of Concept which is able to enumerate the usernames of administrator users. This was possible by performing a timing attack.\n\n### Details\nThe faulty code exists in [`src/Core/Framework/Api/OAuth/UserRepository.php`](https://github.com/shopware/shopware/blob/trunk/src/Core/Framework/Api/OAuth/UserRepository.php):\n```\npublic function getUserEntityByUserCredentials(\n        string $username,\n        #[\\SensitiveParameter]\n        string $password,\n        string $grantType,\n        ClientEntityInterface $clientEntity\n    ): ?UserEntityInterface {\n        if ($this->loginConfigService->getConfig()?->useDefault === false) {\n            // never allow login via password if the default login is disabled (e.g. using SSO only)\n            return null;\n        }\n\n        $builder = $this->connection->createQueryBuilder();\n        $user = $builder->select('user.id', 'user.password')\n            ->from('user')\n            ->where('username = :username')\n            ->setParameter('username', $username)\n            ->fetchAssociative();\n\n        // PATH 1: EARLY RETURN WHEN USERNAME IS NOT FOUND\n        if (!$user) {\n            return null;\n        }\n\n        // PATH 2: VERIFY PASSWORD IF USER IS FOUND\n        if (!password_verify($password, (string) $user['password'])) {\n            return null;\n        }\n\n        return new User(Uuid::fromBytesToHex($user['id']));\n    }\n```\n\nSubroutine `getUserEntityByUserCredentials()` is called when an auth request is send to `api/oauth/token`. If the given username is not found an early return is done (PATH 1). Only if the user is found we verify the password using `password_verify`.\n\nPHP method `password_verify` by default uses hashing algorithm Argon2id which by design is intentionally 'slow' by introducing a timing cost to an attempt to bruteforce hashes more costly.\n\nSince `password_verify` has a notable executable time, PATH 2 where an user is found and verified will be slower on average then PATH 1 where we do an early return for non-existing users.\n\n### Proposed fix\nBefore doing the early return, `password_verify` a dummy hash.\n\n### Impact\n1. More targeted dictionary/bruteforce attacks.\n2. Spear phishing / eases social engineering.\n3. Credential stuffing from other data leaks.\n\n### Authors\nNiel Duysters (@NielDuysters) and Thomas Brankaer (@tbrankaer)",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "shopware/platform"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "6.7.0.0"
      }, {
        "fixed" : "6.7.10.1"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "shopware/platform"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "6.6.10.18"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "shopware/core"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "6.7.0.0"
      }, {
        "fixed" : "6.7.10.1"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "shopware/core"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "6.6.10.18"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/shopware/shopware/security/advisories/GHSA-7w52-7jvm-m9vw"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-48011"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/shopware/shopware"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/shopware/shopware/releases/tag/v6.6.10.18"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/shopware/shopware/releases/tag/v6.7.10.1"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-208" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-06-04T19:31:17Z",
    "nvd_published_at" : "2026-06-10T22:17:00Z"
  }
}