A vulnerability, which was classified as problematic, was found in vendurehq vendure up to 3.5.2. This impacts the function
NativeAuthenticationStrategy.authenticate of the file packages/core/src/config/auth/native-authentication-strategy.ts. The manipulation results in exposure of sensitive information through data queries.
This vulnerability is identified as CVE-2026-25050. The attack can be executed remotely. There is not any exploit available.
You should upgrade the affected component.
