CVE-2026-91154: Ecommerce Template Auth Bypass Vulnerability

CVE-2026-91154 Overview

CVE-2026-91154 is a Missing Authentication for Critical Function flaw [CWE-306] in the MarcosCamara01 Ecommerce Template. The vulnerable revalidateProducts Server Action in src/app/actions.ts invokes updateTag("products") without any session or role validation. Because the file declares "use server" at file scope, the function compiles into a POST-invokable Server Action whose identifier is exposed in the public /_next/static bundle. Any unauthenticated remote attacker can extract that identifier and call the action repeatedly, forcing continuous expiration of the storefront product cache and shifting all traffic onto the Postgres backend.

Critical Impact

Unauthenticated attackers can permanently invalidate the storefront product cache, degrading availability of home, category, product, and search pages at near-zero cost.

Affected Products

• MarcosCamara01 Ecommerce Template versions prior to commit ec97209
• Deployments using Next.js Server Actions with cacheComponents enabled
• Storefronts relying on the products cache tag via getAllProducts, getCategoryProducts, and getProduct

Discovery Timeline

• 2026-09-28 - CVE-2026-91154 published to NVD
• 2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-91154

Vulnerability Analysis

The vulnerability stems from a design mismatch between Next.js Server Action semantics and the application's authorization boundary. Every function exported from src/app/actions.ts becomes a POST-invokable RPC endpoint because of the file-scope "use server" directive. The revalidateProducts function performs a state-changing cache operation but does not verify caller identity or role. In contrast, other exports in the same file are read-only and safe by construction.

Two client components under src/components/admin import revalidateProducts. This import causes the Server Action's opaque identifier to be embedded in a public JavaScript chunk served from /_next/static. The admin middleware defined in proxy.ts protects admin routes but does not gate the Server Action dispatch endpoint. As a result, an unauthenticated attacker can read the identifier from the client bundle and POST to the Server Action endpoint directly.

Root Cause

The root cause is missing authentication on a security-sensitive Server Action. revalidateProducts calls updateTag("products") unconditionally, and the admin middleware does not enforce authentication on the Next.js Server Action transport path. Exposure of the action identifier through client bundle imports completes the exploitable path.

Attack Vector

An attacker downloads the public /_next/static chunks, extracts the Server Action identifier associated with revalidateProducts, and issues repeated POST requests to the Next.js action endpoint. With cacheComponents enabled, getAllProducts, getCategoryProducts, and getProduct serve "use cache" entries tagged products with an hours-long cacheLife. Continuous invalidation forces every subsequent visitor request to bypass cache and read the entire product catalog from Postgres, producing sustained availability degradation.

# Patch reference: .env.example additions in commit ec97209
 GOOGLE_CLIENT_ID=
 GOOGLE_CLIENT_SECRET=
+GOOGLE_AUTH_ENABLED="false"
+NEXT_PUBLIC_GOOGLE_AUTH_ENABLED="false"

 NEXT_PUBLIC_APP_URL="http://localhost:3000"
+BETTER_AUTH_URL="http://localhost:3000"
+APP_URL="http://localhost:3000"

-ADMIN_EMAIL=
+ADMIN_USER_ID=

 BETTER_AUTH_SECRET=
 DATABASE_URL=
+MIGRATION_DATABASE_URL=
+ADMIN_BOOTSTRAP_DATABASE_URL=
# Source: https://github.com/MarcosCamara01/ecommerce-template/commit/ec97209e6c7663cba7b5164468d6946cbfe2f19a

The patch introduces verifiable authentication configuration (BETTER_AUTH_URL, ADMIN_USER_ID, and dedicated bootstrap database URLs) that supports proper gating of admin-only Server Actions.

Detection Methods for CVE-2026-91154

Indicators of Compromise

• Repeated POST requests to Next.js Server Action endpoints originating from unauthenticated clients or unusual IP ranges.
• Sustained cache miss rates on storefront routes (/, /category/*, /product/*, /search) with corresponding Postgres query spikes.
• Requests referencing the compiled Server Action identifier for revalidateProducts extracted from /_next/static chunks.

Detection Strategies

• Correlate POST requests to Server Action endpoints with authentication state; flag any that lack a valid session cookie.
• Baseline updateTag invocation frequency and alert when revalidation events exceed operational norms.
• Monitor for enumeration of /_next/static assets by clients that never authenticate to /admin.

Monitoring Recommendations

• Instrument application logs to record Server Action name, caller identity, and outcome for every invocation.
• Track Postgres query volume for product catalog reads and alert on sudden increases uncorrelated with organic traffic.
• Enable web application firewall (WAF) rules to rate-limit unauthenticated POST requests to the Next.js action endpoint.

How to Mitigate CVE-2026-91154

Immediate Actions Required

• Upgrade the MarcosCamara01 Ecommerce Template to commit ec97209 or later.
• Audit all exports in files declaring "use server" and confirm each state-changing action enforces authentication and authorization.
• Rotate any admin identifiers referenced in updated environment variables such as ADMIN_USER_ID.

Patch Information

The fix is delivered in commit ec97209e6c7663cba7b5164468d6946cbfe2f19a, which introduces verifiable authentication for catalog and fulfillment actions. See the GitHub commit reference and the Secur0 CVE-2026-91154 analysis for technical background.

Workarounds

• Add an explicit session and role check at the top of revalidateProducts before calling updateTag("products").
• Move admin-only Server Actions into a separate file that is only imported by server components gated by admin middleware.
• Deploy WAF or reverse-proxy rules that require authenticated session cookies for POST requests to Next.js Server Action endpoints.

# Example server-side authorization guard for the Server Action
# src/app/actions.ts
"use server";
import { auth } from "@/lib/auth";
import { revalidateTag } from "next/cache";

export async function revalidateProducts() {
  const session = await auth();
  if (!session?.user || session.user.id !== process.env.ADMIN_USER_ID) {
    throw new Error("Unauthorized");
  }
  revalidateTag("products");
}