{"action":"Upgrade shopware/core to 6.6.10.9 or later.","affected":[{"fixed":"6.6.10.9","introduced":"0"},{"fixed":"6.7.4.1","introduced":"6.7.0.0"}],"component":"shopware/core","cve_ids":[],"ecosystem":"Packagist","exploited":false,"fixed_versions":["6.6.10.9","6.7.4.1"],"ghsa_id":"GHSA-2w46-vq8h-98vh","id":"tcs_01M5KESAJKH13VTH7DTSXVR44Y","modified_at":"2026-09-10T03:50:30.406257620Z","published_at":"2025-11-14T20:42:24Z","references":["https://osv.dev/vulnerability/GHSA-2w46-vq8h-98vh","https://github.com/shopware/shopware/security/advisories/GHSA-2w46-vq8h-98vh","https://github.com/shopware/shopware/commit/1338dd9a11e361639704bf8f09b6878552eb8c13","https://github.com/shopware/shopware/commit/2fb94855696a90045b81c503d216ba7df8e64e52","https://github.com/shopware/shopware","https://github.com/shopware/shopware/releases/tag/v6.6.10.9","https://github.com/shopware/shopware/releases/tag/v6.7.0.0","https://github.com/shopware/shopware/releases/tag/v6.7.4.1"],"severity":{"label":"medium","score":5},"sources":[{"source":"osv","source_id":"GHSA-2w46-vq8h-98vh","url":"https://osv.dev/vulnerability/GHSA-2w46-vq8h-98vh"}],"summary":"Shopware 6's password recovery link does not expire after email change"}