Live Exposure Defense: From CVE to Confirmed Exposure in 12 Hours – See more

Back
New CVE Detected

CVE-2026-90896 – Unauthenticated Exposure of Buyer PII – MarcosCamara01 Ecommerce Template (before c

Be the first to know when new zero-days emerge:

Subscribe to Email Alerts
Subscribe to RSS Feed

Summary

CVE-2026-90896 is a missing authentication vulnerability (CWE-306) in the MarcosCamara01 "Ecommerce Template" project that allows unauthenticated users to retrieve sensitive Stripe checkout session data via a public API endpoint. Any party who obtains a valid Stripe checkout session_id — values that are commonly exposed in post-payment redirect URLs, referrer headers, analytics logs, and browser history — can pull the full buyer record without logging in. The issue carries a CVSS score of 8.2 (High), driven by a high confidentiality impact with no authentication or user interaction required.

Technical details

  • Root cause: The GET /api/stripe/checkout_sessions route handler (src/app/api/stripe/checkout_sessions/route.ts) calls stripe.checkout.sessions.retrieve() directly, with no check that the requester is authenticated or owns the session being queried.
  • Inconsistent design: Sibling endpoints, such as POST /api/stripe/payment, already enforce authentication via auth.api.getSession(), making this GET endpoint an outlier that was left unprotected.
  • Trigger conditions: An attacker only needs a valid session_id value. These IDs are exposed in the browser URL after checkout completion and can leak via referrer headers sent to third-party analytics/tracking scripts, server access logs, and browser history on shared devices.
  • Attack vector: Network-based, unauthenticated, low complexity — a single crafted GET request with a captured or guessed session_id is sufficient.
  • Impact: Disclosure of personally identifiable buyer information, including full name, email address, phone number, billing/shipping address, payment amount, and internal user ID tied to the order. There is no integrity or availability impact.

Affected software

  • MarcosCamara01 Ecommerce Template (GitHub repository MarcosCamara01/ecommerce-template)
  • All versions/commits prior to the fix commit 91e273c69d976a3d205179e66e01fc399bfdd08b

Severity

  • CVSS Score: 8.2 (High)
  • CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Mitigation and recommended actions

  • Immediate: Update to a version of the template that includes commit 91e273c69d976a3d205179e66e01fc399bfdd08b or later. This fix requires an active authenticated session (returning HTTP 401 for unauthenticated requests) and verifies that checkoutSession.metadata.userId matches the authenticated user’s ID (returning HTTP 403 on mismatch) before returning checkout session data.
  • If immediate patching is not possible:
    • Restrict or disable public access to the /api/stripe/checkout_sessions GET endpoint at the reverse proxy or API gateway level until the fix is deployed.
    • Avoid exposing raw Stripe session_id values in URLs passed to third-party analytics or tracking scripts, and scrub them from server access logs.
    • Monitor for anomalous, high-volume, or sequential requests to the checkout sessions endpoint, which may indicate session ID enumeration or scraping attempts.
    • Rotate/invalidate any checkout sessions suspected of exposure and notify affected customers if unauthorized access is confirmed.

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report
Close

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Open RSS feedSlack setup instructions

Close

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge