Skip to content
OpenAdvisories

Package · npm

@vendure/core

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Low 2.7
    CVE-2026-25050 Public exploit

    Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy

    Vendure is an open-source headless commerce platform. Prior to version 3.5.3, the `NativeAuthenticationStrategy.authenticate()` method is vulnerable to a timing attack that allows attackers to enumerate valid usernames (email addresses). In `packages/core/src…

    vendurehq vendure @vendure/core npm
  • Low —
    GHSA-h9wq-xcqx-mqxm

    Vendure Cross Site Request Forgery vulnerability impacting all API requests

    ### Impact Vendure is an e-commerce GraphQL framework with a number of APIs and different levels of authorization. By default the Cookie settings are insecure, having the SameSite setting as false which results in not having one (originates from the cookie-se…

    @vendure/core npm