https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 05 Nov 2026 14:38:54 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-63414 <p>Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, `token-exchange` authenticated controllers can expose a request-derived `shop` context instead of the identity from a verified Shopify ID token or active Shopify session. `current_shopify_domain` can resolve to the sanitized `shop` query parameter, so a request authenticated for one `shop` can cause application code to treat a different requested `shop` as current. Affected applications use `shopify_app` `token-exchange` authentication, accept authenticated requests with a `shop` query parameter, and rely on `current_shopify_domain` or `params[:shop]` for authorization, tenant lookup, stored access-token selection or `shop`-scoped data access. An attacker with a valid Shopify session token for one `shop` can supply another `shop` in that parameter and potentially obtain unauthorized application data or perform `shop`-scoped actions, depending on the application&#39;s authorization model. This issue is fixed in version 23.0.3.</p> <p>Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, `token-exchange` authenticated controllers can expose a request-derived `shop` context instead of the identity from a verified Shopify ID token or active Shopify session. `current_shopify_domain` can resolve to the sanitized `shop` query parameter, so a request authenticated for one `shop` can cause application code to treat a different requested `shop` as current. Affected applications use `shopify_app` `token-exchange` authentication, accept authenticated requests with a `shop` query parameter, and rely on `current_shopify_domain` or `params[:shop]` for authorization, tenant lookup, stored access-token selection or `shop`-scoped data access. An attacker with a valid Shopify session token for one `shop` can supply another `shop` in that parameter and potentially obtain unauthorized application data or perform `shop`-scoped actions, depending on the application&#39;s authorization model. This issue is fixed in version 23.0.3.</p> https://db.gcve.eu/vuln/fkie_cve-2026-63414 https://db.gcve.eu/vuln/ghsa-6j52-38f8-qhxr <p><strong>Affected:</strong> RubyGems: shopify_app</p> <p>In token-exchange authenticated controllers, `shopify_app` exposes shop context through helpers such as `current_shopify_domain`. Prior to the fix, `current_shopify_domain` could resolve to the sanitized `shop` query parameter instead of the shop identity derived from the verified Shopify ID token or active Shopify session.</p> <p>As a result, a request authenticated for one shop could include a different `shop` query parameter, causing application code to treat the requested shop as the current shop.</p> <p>Applications that used `current_shopify_domain`, or the request `shop` parameter, for authorization decisions, tenant lookup, stored access-token selection, or shop-scoped data access may have been vulnerable to cross-shop context confusion.</p> <p>The patched version hardens token-exchange handling so that: - `current_shopify_domain` resolves to the authenticated shop from the verified token or session. - `authenticated_shopify_domain` exposes the trusted authenticated shop. - `requested_shopify_domain` exposes the sanitized requested `shop` parameter for bootstrap or routing use cases only. - Token-exchange requests are rejected with `401 Unauthorized` when the requested shop does not match the authenticated shop.</p> <p>## Impact</p> <p>In affected applications, an attacker with a valid Shopify session token for one shop could send an authenticated request that also supplied a different `shop` query parameter. If the application relied on `current_shopify_domain` or `params[:shop]` for…</p> <p><strong>Affected:</strong> RubyGems: shopify_app</p> <p>In token-exchange authenticated controllers, `shopify_app` exposes shop context through helpers such as `current_shopify_domain`. Prior to the fix, `current_shopify_domain` could resolve to the sanitized `shop` query parameter instead of the shop identity derived from the verified Shopify ID token or active Shopify session.</p> <p>As a result, a request authenticated for one shop could include a different `shop` query parameter, causing application code to treat the requested shop as the current shop.</p> <p>Applications that used `current_shopify_domain`, or the request `shop` parameter, for authorization decisions, tenant lookup, stored access-token selection, or shop-scoped data access may have been vulnerable to cross-shop context confusion.</p> <p>The patched version hardens token-exchange handling so that: - `current_shopify_domain` resolves to the authenticated shop from the verified token or session. - `authenticated_shopify_domain` exposes the trusted authenticated shop. - `requested_shopify_domain` exposes the sanitized requested `shop` parameter for bootstrap or routing use cases only. - Token-exchange requests are rejected with `401 Unauthorized` when the requested shop does not match the authenticated shop.</p> <p>## Impact</p> <p>In affected applications, an attacker with a valid Shopify session token for one shop could send an authenticated request that also supplied a different `shop` query parameter. If the application relied on `current_shopify_domain` or `params[:shop]` for…</p> https://db.gcve.eu/vuln/ghsa-6j52-38f8-qhxr