{"action":"Upgrade @vendure/core to 3.7.0 or later.","affected":[{"fixed":"3.7.0","introduced":"0"}],"component":"@vendure/core","cve_ids":["CVE-2026-63472"],"ecosystem":"npm","epss":0.00589,"exploited":false,"fixed_versions":["3.7.0"],"ghsa_id":"GHSA-6j36-r6pr-59x4","id":"tcs_01M5KF79QTHPJGCVRKCQZYTJXW","modified_at":"2026-09-17T15:00:06.681857527Z","published_at":"2026-09-17T14:50:22Z","references":["https://osv.dev/vulnerability/GHSA-6j36-r6pr-59x4","https://github.com/vendurehq/vendure/security/advisories/GHSA-6j36-r6pr-59x4","https://github.com/vendurehq/vendure/commit/3bb04718ea4f9395fda731bd2a4bcfc3afb0a485","https://github.com/vendurehq/vendure","https://github.com/vendurehq/vendure/releases/tag/v3.7.0"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-6j36-r6pr-59x4","url":"https://osv.dev/vulnerability/GHSA-6j36-r6pr-59x4"}],"summary":"Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification"}