https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T14:31:03.132516+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2022-03218 cnvd-2022-03218 2026-10-08T14:31:03.203751+00:00 cnvd-2022-03218 https://cve.radiocsirt.org/vuln/euvd-2026-234536 EUVD-2026-234536 2026-10-08T14:31:03.203795+00:00 EUVD-2026-234536 https://cve.radiocsirt.org/vuln/fkie_cve-2022-21652 fkie_cve-2022-21652 2026-10-08T14:31:03.203810+00:00

Shopware is an open source e-commerce software platform. In affected versions shopware would not invalidate a user session in the event of a password change. With version 5.7.7 the session validation was adjusted, so that sessions created prior to the latest password change of a customer account can't be used to login with said account. This also means, that upon a password change, all existing sessions for a given customer account are automatically considered invalid. There is no workaround for this issue.

 https://cve.radiocsirt.org/vuln/ghsa-p523-jrph-qjc6 GHSA-p523-jrph-qjc6 — Insufficient Session Expiration in shopware 2026-10-08T14:31:03.203846+00:00

Affected: Packagist: shopware/shopware

### Impact

Automatically invalidate sessions upon password change

### Patches

We recommend updating to the current version 5.7.7. You can get the update to 5.7.7 regularly via the Auto-Updater or directly via the download overview.

For older versions you can use the Security Plugin: https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html

### References

https://docs.shopware.com/en/shopware-5-en/securityupdates/security-update-01-2022

 https://cve.radiocsirt.org/vuln/gsd-2022-21652 gsd-2022-21652 2026-10-08T14:31:03.203876+00:00 gsd-2022-21652