Critical Security Alert: Magento 2 GraphQL Tokens Breach Multi-Website Customer Isolation

At Shopping Mover, we're dedicated to ensuring the integrity and security of your Magento 2 (Adobe Commerce and Open Source) platforms, especially during complex migrations and integrations. That's why we're bringing immediate attention to a recently confirmed critical security vulnerability that impacts multi-website Magento 2 installations utilizing website-scoped customer accounts. This flaw, tracked as GitHub Issue #40847, reveals a significant breach in customer isolation, allowing GraphQL-generated tokens to authenticate across separate websites within the same Magento instance.

The Promise of Multi-Website, The Peril of a Flaw

Magento's multi-website capability is a powerful feature, enabling businesses to manage multiple brands, regions, or storefronts from a single backend. A cornerstone of this architecture, particularly for distinct brands or geographical markets, is the ability to configure customer accounts as "website-scoped." This is achieved by setting customer/account_share/scope = 1 in your Magento configuration, which dictates that customer accounts are unique and isolated to each specific website.

The intention is clear: a customer who registers or logs in on Website A should have their session and account strictly confined to Website A. They should not, under any circumstances, be able to use the same credentials or session token to access Website B, C, or any other site within the same Magento instance. This isolation is fundamental for data privacy, security, and maintaining distinct customer experiences across different brands or regions.

Unpacking the Vulnerability: GraphQL's Cross-Site Token Issue

The reported bug, however, demonstrates a severe deviation from this expected and critical security behavior. When a customer logs into Website A using the GraphQL generateCustomerToken mutation, the resulting token, intended solely for Website A, can then be successfully employed to authenticate GraphQL requests against Website B. This effectively bypasses the core security and isolation principles of website-scoped customers.

Consider the following GraphQL mutation used to generate a customer token:

mutation {
    generateCustomerToken(
        email: "customer@example.com"
        password: "password"
    ) {
        token
    }
}

The token returned by this mutation, when executed against Website A, should only be valid for subsequent authenticated requests to Website A. The vulnerability lies in the fact that this very same token can be used in the Authorization: Bearer header for GraphQL requests targeting Website B, granting unauthorized access despite the website-scoped configuration.

Steps to Reproduce (and Confirm)

The issue's reproducibility is straightforward, making it a clear and present danger for affected stores:

1. Configure your Magento 2 instance with website-scoped customers (customer/account_share/scope = 1).
2. Log in to Website A using the generateCustomerToken GraphQL mutation.
3. Obtain the customer token from the response.
4. Send a subsequent GraphQL request to Website B, including the obtained token in the Authorization: Bearer header.

As confirmed by Magento engineering (engcom-Bravo in the GitHub thread), this process successfully authenticates the request against Website B, proving the cross-site token validity. This confirmation elevates the issue to a Severity S1, meaning it affects critical data or functionality and forces users to employ a workaround (or await a patch).

Why This is Critical: The Real-World Impact

The implications of this vulnerability are far-reaching and potentially severe for any Magento 2 multi-website setup:

• Unauthorized Access to Customer Data: A malicious actor or even an unwitting customer could gain access to another website's customer-specific data (e.g., order history, addresses, wishlists) if an account with the same email exists on both sites, or if they can trick a user into generating a token.
• Cross-Site Impersonation: A token from one site could be used to impersonate a customer on another, leading to fraudulent activities or compromised customer experiences.
• Data Integrity and Privacy Concerns: The fundamental principle of customer data isolation is breached, potentially leading to compliance issues with regulations like GDPR, CCPA, and others.
• Erosion of Trust: Such vulnerabilities can severely damage customer trust in your brand and platform security.

What This Means for Your Magento 2 Store

If you operate a Magento 2 multi-website store with website-scoped customers and utilize GraphQL for customer authentication, your store is likely affected. This vulnerability underscores the importance of:

• Vigilant Monitoring: Keep a close eye on official Adobe Commerce security bulletins and Magento 2 GitHub releases for the official patch addressing this issue.
• Security Audits: Regularly audit your GraphQL endpoints and authentication flows, especially in multi-website environments.
• Proactive Patching: Once a patch is released, prioritize its implementation immediately.

Shopping Mover's Perspective: Proactive Security in Migrations & Development

At Shopping Mover, we understand that security is paramount, especially when undertaking significant projects like Magento migrations or developing new integrations. This GraphQL token vulnerability highlights why a thorough, expert-led approach is crucial:

• Pre-Migration Audits: We conduct comprehensive security audits before any migration to identify existing vulnerabilities and ensure your new Magento 2 instance is built on a secure foundation.
• Secure Development Practices: Our development teams adhere to best practices, ensuring that custom modules and integrations do not introduce new security flaws.
• Post-Migration Verification: After a migration, we rigorously test all functionalities, including authentication and multi-website isolation, to confirm everything works as expected and securely.
• Staying Ahead: We continuously monitor Magento's ecosystem for new threats and updates, advising our clients on necessary patches and security enhancements.

Don't let security vulnerabilities undermine your e-commerce success. Whether you're planning a Magento migration, need assistance with complex multi-website configurations, or require an expert security audit, Shopping Mover is here to help you build and maintain a robust, secure, and high-performing Adobe Commerce platform.

Next Steps & Staying Secure

For now, the most critical action is to stay informed. Monitor the official Magento 2 GitHub repository for updates on Issue #40847 and subscribe to Adobe Commerce security advisories. When the official patch is released, prioritize its application to safeguard your customer data and maintain the integrity of your multi-website setup.

If you have concerns about your current Magento 2 security posture or need expert guidance on managing your multi-website environment, contact Shopping Mover today. Our team of Magento migration and development experts is ready to assist you in securing your e-commerce future.