GHSA-54hq-mf6h-48xh
PrestaShop Checkout allows customer account takeover via email
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | prestashop/ps_checkout | >= 1.3.0, < 4.4.1 | 4.4.1 |
| Packagist | prestashop/ps_checkout | >= 5.0.0, < 5.0.5 | 5.0.5 |
Details
As written in the advisory (Markdown source, shown as plain text).
# Impact
Missing validation on Express Checkout feature allows silent log-in
## Affected versions
The issue was introduced in PrestaShop Checkout 1.3.0 .
All versions above 1.3.0 are vulnerable except of course the patch versions published on 16/10/2025: 7.4.4.1, 8.4.4.1, 7.5.0.5, 8.5.0.5, 9.5.0.5
# Patches
The problem has been patched in versions
- v4.4.1 for PrestaShop 1.7 (build number: 7.4.4.1)
- v4.4.1 for PrestaShop 8 (build number: 8.4.4.1)
- v5.0.5 for PrestaShop 1.7 (build number: 7.5.0.5)
- v5.0.5 for PrestaShop 8 (build number: 8.5.0.5)
- v5.0.5 for PrestaShop 9 (build number: 9.5.0.5)
Read our [Versioning policy](https://github.com/PrestaShopCorp/ps_checkout/wiki/Versioning) to learn more about our build numbers and versions of PrestaShop Checkout
# Credits
We would like to thank [Léo CUNÉAZ](https://github.com/inem0o) for reporting the issue.
References
External links from the advisory. They lead to third-party sites.