Skip to content
Secur0
Solutions
View all AI Agent Security New Protect your AI agents Vulnerability Disclosure Secure reporting channel Penetration Testing Expert manual audits Crowdsourced Pentest Thousands of hackers, one goal Bug Bounty Success-based payment Live Hacking Live real-time pentesting For company teams Train your technical team For educational centers Bring hacking to the classroom For hackers Learn and get certified Competitions / CTFs Put your skills to the test
Customer Stories
View all Penetration Testing Manual pentesting VDP Secure reporting channel Pentest In-depth audits Crowdsourced Pentest Thousands of hackers, one goal Bug Bounty Success-based payment
Resources
About Secur0 Get to know us Jobs Join the team Media Kit Brand resources Contact Talk to us Newsletter Industry news Blog Articles and guides Partners Join the partner network We are a CNA We are a CVE Numbering Authority
Are you a hacker?
Request a demo Log in
Español English
Back to list
CVE-2026-90896 ·
High · September 14, 2026

Missing authentication in Ecommerce Template checkout session endpoint allows unauthenticated disclosure of buyer PII

S0
Secur0 CNA
CVE-2026-90896

Description

Missing Authentication for Critical Function (CWE-306) in the checkout session lookup handler GET() (src/app/api/stripe/checkout_sessions/route.ts), exposed at GET /api/stripe/checkout_sessions, in Ecommerce Template before commit 91e273c, which allows a remote, unauthenticated attacker holding a valid Stripe Checkout Session id (cs_...) to read the buyer's full checkout session, because the handler calls stripe.checkout.sessions.retrieve() and returns the resulting object without any authentication or ownership check, unlike the sibling endpoint POST /api/stripe/payment, which enforces authentication through auth.api.getSession(). The returned object exposes the buyer's personal data (full name, email, phone, billing address, amount paid and the internal userId). The required session_id is placed in the buyer's own post-payment URL (success_url = /result?session_id={CHECKOUT_SESSION_ID}), so it can leak through Referer headers, analytics tools and server logs. This results in disclosure of the buyer's personal information to an unauthenticated actor.

Vulnerability type (CWE)

CWE-306: Missing Authentication for Critical Function

Affected versions

Ecommerce Template in all versions before commit 91e273c. The vulnerable endpoint was introduced when the route file was created in commit 95d08e6 (2023-09-14) and remained without any access control until the fix. The repository publishes no tags or releases and its package.json is pinned at 0.1.0, so there is no semantic version to reference; the affected range is therefore expressed by commit. The fix is contained in commit 91e273c (2026-08-01) on the master branch, which no published release carries. Default status: unaffected.

Score (CVSS 4.0)

High (8.2)

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Solution

Upgrade to a build that includes commit 91e273c by deploying from the master branch: the repository publishes no tags or releases, so there is no fixed version number to pin. The fix adds an authentication check via auth.api.getSession() that returns 401 when there is no active session, and an ownership check comparing checkoutSession.metadata.userId against the authenticated user id that returns 403 when they do not match, before the checkout session is returned.

Patch

Commit 91e273c

Credits

  • Jaime Ramírez - finder
  • Darío Rivas Quero - analyst
  • Secur0 CNA - coordinator

Discovery source: External

Official record: CVE-2026-90896