CVE-2022-21652

Shopware is an open source e-commerce software platform. In affected versions shopware would not invalidate a user session in the event of a password change. With version 5.7.7 the session validation was adjusted, so that sessions created prior to the latest password change of a customer account can't be used to login with said account. This also means, that upon a password change, all existing sessions for a given customer account are automatically considered invalid. There is no workaround for this issue.

• CWE-613
• CWE-613

• https://docs.shopware.com/en/shopware-5-en/securityupdates/security-update-01-2022Patch, Vendor Advisory
• https://github.com/shopware/shopware/commit/47ebd126a94f4b019b6fde64c0df3d18d74ef7d0Patch, Third Party Advisory
• https://github.com/shopware/shopware/security/advisories/GHSA-p523-jrph-qjc6Patch, Third Party Advisory
• https://docs.shopware.com/en/shopware-5-en/securityupdates/security-update-01-2022Patch, Vendor Advisory
• https://github.com/shopware/shopware/commit/47ebd126a94f4b019b6fde64c0df3d18d74ef7d0Patch, Third Party Advisory
• https://github.com/shopware/shopware/security/advisories/GHSA-p523-jrph-qjc6Patch, Third Party Advisory

Published

Jan 5, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-21647CodeIgniter is an open source PHP full-stack web framework. …9.8
• CVE-2022-21648Latte is an open source template engine for PHP. Versions si…6.1
• CVE-2022-21649Convos is an open source multi-user chat that runs in a web …5.4
• CVE-2022-2165Insufficient data validation in URL formatting in Google Chr…4.3
• CVE-2022-21650Convos is an open source multi-user chat that runs in a web …5.4
• CVE-2022-21651Shopware is an open source e-commerce software platform. An …6.1
• CVE-2022-21653Jawn is an open source JSON parser. Extenders of the `org.ty…7.5
• CVE-2022-21654Envoy is an open source edge and service proxy, designed for…9.8
• CVE-2022-21655Envoy is an open source edge and service proxy, designed for…7.5
• CVE-2022-21656Envoy is an open source edge and service proxy, designed for…5.9
• CVE-2022-21657Envoy is an open source edge and service proxy, designed for…6.5
• CVE-2022-21658Rust is a multi-paradigm, general-purpose programming langua…6.3