{"data":{"id":"magento2-40858","source":"github-pr","sourceRef":"magento/magento2#40858","title":"Customer Token Generated on Website A Can Be Used on Website B in Website-Scoped Customer Configuration","pr":{"number":40858,"url":"https://github.com/magento/magento2/pull/40858","author":"aasim110","mergedAt":"2026-08-24T14:44:48Z","mergeCommit":"c795a722e4820a00c088659e50a2c26f47b51e7a","headCommit":"d1f31fdef447812304b99513c97ae02a8c7b8f76","baseRef":"2.4-develop","diffSha256":"307219039d6a182765845c40dbf4f4c8226d84f3be1d9e90d8c11fa8350a8446"},"issues":[{"number":40847,"url":"https://github.com/magento/magento2/issues/40847","title":"Customer Token Generated on Website A Can Be Used on Website B in Website-Scoped Customer Configuration","labels":["Component: GraphQL","Issue: Confirmed","Priority: P2","Progress: PR Created","Progress: done","Reported on 2.4.x","Reproduced on 2.4.x"],"kind":"human"}],"fixedIn":null,"containingTags":[],"reportedOn":null,"codeMatch":{"2.4.6":"conflict","2.4.6-p1":"conflict","2.4.6-p2":"conflict","2.4.6-p3":"conflict","2.4.6-p4":"conflict","2.4.6-p5":"conflict","2.4.6-p6":"conflict","2.4.6-p7":"conflict","2.4.6-p8":"conflict","2.4.6-p9":"conflict","2.4.6-p10":"conflict","2.4.6-p11":"conflict","2.4.6-p12":"conflict","2.4.6-p13":"conflict","2.4.6-p14":"conflict","2.4.6-p15":"conflict","2.4.7":"clean","2.4.7-p1":"clean","2.4.7-p2":"clean","2.4.7-p3":"clean","2.4.7-p4":"clean","2.4.7-p5":"clean","2.4.7-p6":"clean","2.4.7-p7":"clean","2.4.7-p8":"clean","2.4.7-p9":"clean","2.4.7-p10":"clean","2.4.8":"clean","2.4.8-p1":"clean","2.4.8-p2":"clean","2.4.8-p3":"clean","2.4.8-p4":"clean","2.4.8-p5":"clean","2.4.9":"clean"},"affectedVersions":["2.4.7","2.4.7-p1","2.4.7-p2","2.4.7-p3","2.4.7-p4","2.4.7-p5","2.4.7-p6","2.4.7-p7","2.4.7-p8","2.4.7-p9","2.4.7-p10","2.4.8","2.4.8-p1","2.4.8-p2","2.4.8-p3","2.4.8-p4","2.4.8-p5","2.4.9"],"components":["magento/module-customer-graph-ql"],"files":[{"path":"app/code/Magento/CustomerGraphQl/Model/Resolver/CacheKey/FactorProvider/CurrentWebsiteId.php","change":"added","package":"magento/module-customer-graph-ql"},{"path":"app/code/Magento/CustomerGraphQl/etc/graphql/di.xml","change":"modified","package":"magento/module-customer-graph-ql"}],"stripped":{"tests":["app/code/Magento/CustomerGraphQl/Test/Unit/Model/Resolver/CacheKey/FactorProvider/CurrentWebsiteIdTest.php","dev/tests/api-functional/testsuite/Magento/GraphQl/CustomerGraphQl/Model/Resolver/CustomerTest.php"],"docs":[],"outsideCode":[]},"linesChanged":40,"mergeBatched":false,"excluded":null,"sections":{"description":"A token generated on Website A can be reused successfully on Website B, allowing authentication across websites despite website-scoped customer configuration.","stepsToReproduce":"Steps to Reproduce\n\t1.\tConfigure Magento with website-scoped customers.\n\t2.\tLog in to Website A using generateCustomerToken.\n\t3.\tObtain the customer token.\n\t4.\tSend a GraphQL request to Website B using: Authorization: Bearer <token_from_website_A>","expectedResult":"When customer accounts are website-scoped, a customer token generated for Website A should only be valid for the customer account belonging to Website A. The token should not authenticate requests against a different website that has a separate customer scope.","actualResult":"A token generated on Website A can be reused successfully on Website B, allowing authentication across websites despite website-scoped customer configuration.","source":"issue"},"signatures":[],"labels":{"area":[],"component":["GraphQL"],"priority":"P2","severity":null,"reportedOn":["2.4.x"]},"categories":["GraphQL"],"triage":{"model":"@cf/cloudflare/clef","requestHash":"421a5739904ea41ac2d2501df13d4945782500b0ee4955ab1db8f8fc5e6310fe","isBugfix":0.9836,"changeKind":{"choice":"bugfix","probabilities":{"bugfix":0.9419,"feature":0.0201,"refactor":0.0154,"tests_only":0.0124,"docs_only":0.0049,"dependency":0.0053},"confidence":0.8657},"scope":{"score":0.5952,"probabilities":{"0":0.5765,"1":0.2518,"2":0.1717},"confidence":0.1378},"risk":{"score":1.252,"probabilities":{"0":0.3146,"1":0.1189,"2":0.5665},"confidence":0.1511},"area":{"choice":"graphql_api","probabilities":{"catalog":0.0047,"checkout":0.0048,"customer":0.2633,"admin":0.0048,"graphql_api":0.6884,"framework":0.0248,"frontend":0.0044,"other":0.0048},"confidence":0.4788},"securityRelevant":0.9685,"reportedVersion":{"choice":"unspecified","probabilities":{"2.4.0":0.0035,"2.4.0-p1":0.0034,"2.4.1":0.0036,"2.4.1-p1":0.0032,"2.4.2":0.005,"2.4.2-p1":0.0042,"2.4.2-p2":0.0052,"2.4.3":0.0075,"2.4.3-p1":0.0071,"2.4.3-p2":0.0077,"2.4.3-p3":0.0051,"2.4.4":0.0132,"2.4.4-p1":0.0062,"2.4.4-p10":0.0055,"2.4.4-p11":0.0064,"2.4.4-p12":0.0061,"2.4.4-p13":0.0061,"2.4.4-p14":0.0068,"2.4.4-p15":0.005,"2.4.4-p16":0.0059,"2.4.4-p17":0.0056,"2.4.4-p18":0.0043,"2.4.4-p2":0.0027,"2.4.4-p3":0.0031,"2.4.4-p4":0.0031,"2.4.4-p5":0.0035,"2.4.4-p6":0.0036,"2.4.4-p7":0.0041,"2.4.4-p8":0.0042,"2.4.4-p9":0.0039,"2.4.5":0.0121,"2.4.5-p1":0.0084,"2.4.5-p10":0.0064,"2.4.5-p11":0.0093,"2.4.5-p12":0.0085,"2.4.5-p13":0.0065,"2.4.5-p14":0.0087,"2.4.5-p15":0.0059,"2.4.5-p16":0.008,"2.4.5-p17":0.0073,"2.4.5-p2":0.0036,"2.4.5-p3":0.0046,"2.4.5-p4":0.0052,"2.4.5-p5":0.0046,"2.4.5-p6":0.0053,"2.4.5-p7":0.0057,"2.4.5-p8":0.0057,"2.4.5-p9":0.0049,"2.4.6":0.0202,"2.4.6-p1":0.0166,"2.4.6-p10":0.0097,"2.4.6-p11":0.012,"2.4.6-p12":0.0089,"2.4.6-p13":0.0087,"2.4.6-p14":0.009,"2.4.6-p15":0.0089,"2.4.6-p2":0.0041,"2.4.6-p3":0.0065,"2.4.6-p4":0.0082,"2.4.6-p5":0.0063,"2.4.6-p6":0.0072,"2.4.6-p7":0.0081,"2.4.6-p8":0.0064,"2.4.6-p9":0.0055,"2.4.7":0.0253,"2.4.7-p1":0.0166,"2.4.7-p10":0.0101,"2.4.7-p2":0.0097,"2.4.7-p3":0.0126,"2.4.7-p4":0.017,"2.4.7-p5":0.0125,"2.4.7-p6":0.0178,"2.4.7-p7":0.0151,"2.4.7-p8":0.0106,"2.4.7-p9":0.0075,"2.4.8":0.025,"2.4.8-p1":0.0169,"2.4.8-p2":0.0221,"2.4.8-p3":0.0155,"2.4.8-p4":0.0189,"2.4.8-p5":0.0148,"2.4.9":0.0212,"unspecified":0.289},"confidence":0.0809},"backportWorthy":{"score":1.6095,"probabilities":{"0":0.0689,"1":0.2527,"2":0.6784},"confidence":0.2933}},"curated":{"title":"Fixes Customer resolver cache hits across websites with website-scoped customers","description":"With website-scoped customers, the issue says a token generated with generateCustomerToken on Website A can authenticate GraphQL requests against Website B. The diff does not change token validation: it adds a CurrentWebsiteId factor to the resolver cache key of the CustomerGraphQl Customer resolver, to prevent cross-website cache hits.","categories":["GraphQL"],"author":"claude-code/opus-5.5","date":"2026-10-06","reviewedBy":null},"tests":{"2.4.8-p5":{"before":"fail","after":"pass","adapted":false,"runAt":"2026-10-06T10:08:46.844Z","releaseCommit":"870a22c63d9d9b68fa3297962e2d5d5841115814","suites":{"unit":{"before":"not-runnable","after":"pass","runAt":"2026-10-06T09:38:49.990Z"},"api-functional":{"before":"fail","after":"pass","runAt":"2026-10-06T10:08:46.844Z"}}},"2.4.9":{"before":"fail","after":"error","adapted":false,"runAt":"2026-10-06T10:09:35.498Z","releaseCommit":"755e34dd689021c5165db9d35ecff74f7dc51527","suites":{"unit":{"before":"not-runnable","after":"pass","runAt":"2026-10-06T09:39:56.583Z"},"api-functional":{"before":"not-runnable","after":"error","runAt":"2026-10-06T10:09:35.498Z","aggregateBefore":"fail"}}},"2.4.7-p10":{"before":"fail","after":"pass","adapted":false,"runAt":"2026-10-06T10:59:31.024Z","releaseCommit":"72561bf80652f57cc642a03e2c9a51d74a285b14","suites":{"unit":{"before":"not-runnable","after":"pass","runAt":"2026-10-06T10:03:20.099Z"},"api-functional":{"before":"fail","after":"pass","runAt":"2026-10-06T10:59:31.024Z"}}}}},"_documentation":"https://magento.watch/api","_description":"Upstream fix magento2-40858 details"}