CVE-2025-61922: PrestaShop Checkout Auth Bypass Vulnerability

CVE-2025-61922 Overview

CVE-2025-61922 is a critical authentication bypass vulnerability affecting PrestaShop Checkout, the official PrestaShop payment module developed in partnership with PayPal. The vulnerability exists in the Express Checkout feature due to missing validation, which allows attackers to perform silent login operations. This flaw enables account takeover via email manipulation, potentially compromising customer accounts on affected e-commerce platforms.

Critical Impact

Attackers can bypass authentication and take over customer accounts through the Express Checkout feature, enabling unauthorized access to payment information and customer data.

Affected Products

• PrestaShop Checkout versions 1.3.0 through 4.4.0
• PrestaShop Checkout versions 5.0.0 through 5.0.4
• PrestaShop e-commerce platforms utilizing the vulnerable ps_checkout module

Discovery Timeline

• 2025-10-16 - CVE-2025-61922 published to NVD
• 2025-12-29 - Last updated in NVD database

Technical Details for CVE-2025-61922

Vulnerability Analysis

This authentication bypass vulnerability (CWE-287) stems from inadequate validation in the Express Checkout feature of the PrestaShop Checkout module. The flaw allows attackers to exploit the checkout process to gain unauthorized access to customer accounts without proper authentication. When the Express Checkout feature processes a request, it fails to properly verify the identity of the user, enabling what is known as a "silent login" attack. This silent login mechanism can be leveraged to associate an attacker's session with a victim's account using only the victim's email address.

The network-accessible nature of this vulnerability means any attacker with network access to a vulnerable PrestaShop installation can attempt exploitation without any prior authentication or user interaction required. The impact primarily affects confidentiality and integrity of customer accounts, with attackers potentially gaining access to saved payment methods, order history, and personal information.

Root Cause

The root cause of this vulnerability lies in the Express Checkout feature's failure to implement proper input validation and authentication checks during the checkout flow. Specifically, the module does not adequately verify that the user initiating an Express Checkout session is the legitimate owner of the associated email address. This missing validation creates a trust boundary violation where untrusted user input (email address) is used to establish an authenticated session.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker can craft malicious requests to the Express Checkout endpoint, providing a target victim's email address. Due to the missing validation, the system processes this request and grants the attacker authenticated access to the victim's account. The attacker can then access sensitive information, modify account details, or perform unauthorized transactions.

The exploitation process involves targeting the Express Checkout API endpoint with a victim's email address, whereupon the vulnerable module creates an authenticated session for the attacker under the victim's account context. A proof-of-concept demonstrating this attack vector is publicly available at the CVE-2025-61922 PoC repository.

Detection Methods for CVE-2025-61922

Indicators of Compromise

• Unusual login patterns from multiple IP addresses for the same customer account
• Express Checkout sessions initiated with email addresses that don't match the requesting user's typical behavior
• Account modifications or order placements occurring without corresponding user authentication events
• Multiple failed or successful Express Checkout attempts from a single IP targeting different email addresses

Detection Strategies

• Monitor Express Checkout API endpoint logs for anomalous request patterns targeting multiple email addresses
• Implement rate limiting detection on checkout endpoints to identify brute-force account takeover attempts
• Deploy web application firewall (WAF) rules to detect and block suspicious Express Checkout requests
• Correlate login events with checkout activity to identify sessions where authentication was bypassed

Monitoring Recommendations

• Enable verbose logging for the ps_checkout module to capture all Express Checkout transactions
• Configure alerts for account changes (email, password, payment methods) occurring shortly after Express Checkout sessions
• Monitor for unusual geographic patterns in checkout sessions that don't align with customer profiles
• Review application logs regularly for failed validation attempts or error messages related to the checkout flow

How to Mitigate CVE-2025-61922

Immediate Actions Required

• Upgrade PrestaShop Checkout to version 4.4.1 or 5.0.5 immediately
• Review recent Express Checkout sessions and account modifications for potential compromise
• Notify affected customers to verify their account security and change passwords if suspicious activity is detected
• Consider temporarily disabling the Express Checkout feature until patching is complete

Patch Information

PrestaShop has released security patches addressing this vulnerability. Merchants should update to the following fixed versions:

• Version 4.4.1 - For installations running the 4.x branch
• Version 5.0.5 - For installations running the 5.x branch

Detailed patch information and upgrade instructions are available in the GitHub Security Advisory GHSA-54hq-mf6h-48xh.

Workarounds

• No known workarounds exist for this vulnerability according to the vendor advisory
• Organizations unable to patch immediately should consider disabling the Express Checkout feature entirely
• Implement additional monitoring and detection measures as outlined above until patching is possible
• Consider implementing additional authentication verification at the application layer for checkout operations

# Verify your current PrestaShop Checkout module version
# Navigate to PrestaShop admin and check Module Manager
# Or check via command line:
grep -r "version" /path/to/prestashop/modules/ps_checkout/config.xml

# Update module via Composer (if applicable)
composer update prestashop/ps_checkout