Magento 2 Multi-Website Security Alert: GraphQL Tokens Cross-Contaminate Customer Sessions

Magento 2 Multi-Website Security Alert: GraphQL Tokens Cross-Contaminate Customer Sessions

A critical security vulnerability has been identified and confirmed in Magento 2 (including 2.4.x versions), impacting multi-website configurations that utilize website-scoped customer accounts. The issue, reported on GitHub as #40847, reveals that a customer token generated via GraphQL on one website can be illicitly used to authenticate requests on an entirely separate website within the same Magento instance, despite explicit settings designed to prevent such cross-site access.

The Intended Behavior vs. The Bug

Magento's multi-website functionality is a cornerstone for many e-commerce businesses, allowing them to manage multiple brands or regions from a single backend. A crucial aspect of this setup is the ability to configure customer accounts to be "website-scoped." This is achieved by setting customer/account_share/scope = 1 in the Magento configuration, ensuring that customer accounts are unique to each website. The expectation is clear: a customer logging into Website A should have an account and session strictly confined to Website A, completely isolated from Website B, C, or any other site within the instance.

However, the reported bug demonstrates a severe deviation from this expected behavior. When a customer logs in on Website A using the GraphQL generateCustomerToken mutation:

mutation {
    generateCustomerToken(
        email: "customer@example.com"
        password: "password"
    ) {
        token
    }
}

The resulting token, intended solely for Website A, can then be successfully employed to authenticate GraphQL requests against Website B. This bypasses the fundamental security and isolation principles of website-scoped customers, creating a significant vulnerability.

Reproducing the Vulnerability

The steps to reproduce this issue are straightforward, highlighting its critical nature:

1. Configure Magento with website-scoped customers (customer/account_share/scope = 1).
2. Log in to Website A using the generateCustomerToken GraphQL mutation.
3. Obtain the customer token from the response.
4. Attempt to send a GraphQL request to Website B, including the header: Authorization: Bearer .

The actual result is that the request to Website B is authenticated, allowing access to customer-specific data or actions on a website where the token should be invalid.

Implications for Magento 2 Merchants and Developers

This bug carries serious implications, particularly for businesses operating multi-brand or multi-region stores on a single Magento instance:

• Security Risk: Customer data privacy is compromised. A malicious actor obtaining a token from one website could potentially access sensitive information or perform actions on behalf of a customer on another website.
• Data Integrity: The separation of customer data across websites is undermined, potentially leading to inconsistencies or unauthorized data access.
• Compliance Issues: Businesses must ensure strict data isolation for compliance with regulations like GDPR or CCPA. This bug could complicate adherence to such standards.
• Development Challenges: Developers building GraphQL integrations for multi-website Magento setups must be aware of this flaw and potentially implement temporary workarounds until an official fix is released.

Community Response and Next Steps

The Magento community has quickly recognized the severity of this issue. The bug has been officially confirmed by the Magento engineering team, and a developer has been assigned to work on a resolution. This indicates that Adobe Commerce acknowledges the problem and is actively pursuing a fix. While no immediate workarounds or patches have been provided within the GitHub thread, users are advised to monitor the official Magento GitHub repository for updates and potential solutions.

For merchants and developers running multi-website Magento 2 instances with GraphQL, staying informed about this issue is paramount. Until a patch is available, it's crucial to assess the potential impact on your specific setup and consider temporary mitigation strategies if necessary.

Shopping Mover will continue to monitor critical Magento updates and provide insights to help you navigate the complexities of your e-commerce platform.