Shopware has user enumeration via distinct error codes on Store API login endpoint

Vulnerability

The Store API login endpoint (POST /store-api/account/login) in Shopware versions prior to 6.7.8.7.1 and 6.6.10.15 returns different error codes depending on whether the submitted email address belongs to a registered. If the email is unknown, a CustomerNotFoundException with code CHECKOUT__CUSTOMER_NOT_FOUND is thrown, and the response echoes the probed email. If the email exists but the password is wrong, a BadCredentialsException with CHECKOUT__CUSTOMER_AUTH_BAD_CREDENTIALS is returned [1][2]. This observable response discrepancy (CWE-204) allows an unauthenticated attacker to identify which email addresses belong to valid customer accounts.

Exploitation

The difference originates in AccountService::getCustomerByLogin() which calls getCustomerByEmail() first, catching two distinct exception types [1]. The attacker simply sends login requests with different email addresses and observes the error code in the JSON response; no authentication required. No authenticated session is required, making the attack lightweight and automated [2]. The storefront login controller correctly unifies both error paths, but the Store API does not, indicating an inconsistent defense [1][2].

Impact

By enumerating valid customer accounts, an attacker can build a list of active users on a Shopware instance. This information can be used for targeted phishing, credential stuffing, or social engineering campaigns. The attack does not compromise the account itself, but leaks sensitive information about the user base [1][2].

Mitigation

The vulnerability is fixed in Shopware versions 6.7.8.1 and 6.6.10.15 [1][2]. Users should upgrade to these versions or later. No workaround is mentioned; a full patch is required to unify the error codes [1].