Shopware Core vulnerabilities

CVE-2026-48011 [LOW] CWE-208 Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames ### Summary There is a Proof of Concept which is able to enumerate the usernames of administrator users. This was possible by performing a timing attack. ### Details The faulty code exists in [`src/Core/Framework/Api/OAuth/UserRepository.php`](https://github.com/shopware/shopware/blob/trunk/src

CVE-2022-24744 [LOW] CWE-613 Shopware user session is not logged out if the password is reset via password recovery Shopware user session is not logged out if the password is reset via password recovery ### Impact User session is not logged out if the password is reset via password recovery ## Patches Fixed in 6.4.8.1, maintainers recommend updating to the current version 6.4.8.2. You can get the update to 6.4.8.2 regularly via the Auto-Updater or directly via the download overview. https://w