Shopware Password Reset Vulnerability Leading to Session Retention

A vulnerability exists in Shopware versions through 6.1.0, where user sessions remain active after a password is reset via the password recovery process. This issue has been addressed in version 6.4.8.1. For users on older versions 6.1, 6.2, and 6.3, a plugin is available to implement the necessary security measures.

Impact

This vulnerability allows for user sessions to remain active even after a password reset, which could lead to unauthorized access if the session is hijacked.

Remediation

Users are advised to update to Shopware version 6.4.8.2, available through the Auto-Updater or the Shopware download overview. For versions 6.1, 6.2, and 6.3, a plugin is available to address this vulnerability.