CVE-2026-31889: CVE-2026-31889: Shopware App Registration Flow Credential Takeover

CVE-2026-31889: Shopware App Registration Flow Credential Takeover Vulnerability ID: CVE-2026-31889 CVSS Score: 8.9 Published: 2026-03-11 CVE-2026-31889 is a critical vulnerability within the Shopware open commerce platform's app registration flow. The flaw exists in the legacy HMAC-based handshake mechanism used for app re-registration. It permits an unauthenticated attacker to spoof registration requests and hijack communication channels, leading to the unauthorized interception of API credentials and integration tokens. TL;DR Shopware versions prior to 6.6.10.15 and 6.7.8.1 fail to require a proof-of-possession signature during app re-registration. Attackers possessing a shared App Secret can modify a shop's URL routing metadata to intercept API tokens and webhooks. Technical Details CWE ID : CWE-290 Attack Vector : Network CVSS Score : 8.9 Impact : Credential Takeover, Communication Hijacking Exploit Status : Unexploited KEV Status : Not Listed Affected Systems Shopware Core Shopwa