CVE-2026-63105

The CVSS 5.4 rating for CVE-2026-63105 fundamentally misrepresents the actual risk posture by collapsing a multi-stage attack chain into a single exploitation moment. An attacker creates a throwaway customer account, submits a crafted payload through the support system, and waits. The actual exploit executes when a shop owner or administrator opens that ticket to respond. The session cookie lands in the attacker's hands, delivering full administrative control over a commercial platform processing transactions—yet CVSS measures only the window from payload submission to script execution as a medium-severity event. The critical variable is session cookie configuration. If ReadyEcommerce's admin sessions lack HttpOnly flags, XSS trivially becomes session hijacking without additional complexity. Even with HttpOnly enabled, SameSite=Lax or None permits cross-origin exploitation. The difference between a 5.4 and an 8.1 often comes down to one configuration flag—treat the CVSS score as a floor, not a ceiling, until cookie controls are verified. Four Vue files share the same unsafe v-html pattern, suggesting this isn't an isolated mistake but a systemic architectural decision—likely prioritizing rich-text message rendering over input sanitization. The 'authenticated users only' constraint in the CVE description is functionally meaningless: customer registration requires no vetting, no email verification, no CAPTCHA. The authentication boundary is cosmetic from an attacker perspective. Once admin access is compromised, the blast radius extends beyond the platform itself. Attackers can modify payment processor configurations, inject malicious code into product downloads, alter shipping destinations for fraud, and exfiltrate the entire customer PII database. This isn't a corporate wiki compromise—it's a commercial transaction platform with financial, supply chain, and regulatory exposure. What to check: verify HttpOnly, SameSite=Strict, and Secure flags on admin session cookies. Audit the codebase for additional v-html instances—the four affected files probably represent visible symptoms of a codebase-wide assumption about trust boundaries. Examine whether this pattern exists elsewhere where CVSS might score even lower. Determine whether the fix implements server-side sanitization before storage, output encoding at render time, or removes v-html entirely—each represents a different confidence level in remediation.

Reviewed through automated stages and approved by a human before publication.