Vulnerability-Lookup

CVE-2026-63414 (GCVE-0-2026-63414)

Vulnerability from cvelistv5 – Published: 2026-10-30 22:49 – Updated: 2026-11-05 03:01

Title

Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps

Summary

Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, `token-exchange` authenticated controllers can expose a request-derived `shop` context instead of the identity from a verified Shopify ID token or active Shopify session. `current_shopify_domain` can resolve to the sanitized `shop` query parameter, so a request authenticated for one `shop` can cause application code to treat a different requested `shop` as current. Affected applications use `shopify_app` `token-exchange` authentication, accept authenticated requests with a `shop` query parameter, and rely on `current_shopify_domain` or `params[:shop]` for authorization, tenant lookup, stored access-token selection or `shop`-scoped data access. An attacker with a valid Shopify session token for one `shop` can supply another `shop` in that parameter and potentially obtain unauthorized application data or perform `shop`-scoped actions, depending on the application's authorization model. This issue is fixed in version 23.0.3.

Severity

7.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-05 03:01 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7886 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/Shopify/shopify_app/security/a…	x_refsource_CONFIRM
https://github.com/Shopify/shopify_app/pull/2081	x_refsource_MISC
https://github.com/Shopify/shopify_app/commit/a09…	x_refsource_MISC
https://github.com/Shopify/shopify_app/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
Shopify	shopify_app	Affected: >= 22.1.0, < 23.0.3	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63414",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-05T03:01:30.497571Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-05T03:01:40.702Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "shopify_app",
          "vendor": "Shopify",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 22.1.0, \u003c 23.0.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, `token-exchange` authenticated controllers can expose a request-derived `shop` context instead of the identity from a verified Shopify ID token or active Shopify session. `current_shopify_domain` can resolve to the sanitized `shop` query parameter, so a request authenticated for one `shop` can cause application code to treat a different requested `shop` as current. Affected applications use `shopify_app` `token-exchange` authentication, accept authenticated requests with a `shop` query parameter, and rely on `current_shopify_domain` or `params[:shop]` for authorization, tenant lookup, stored access-token selection or `shop`-scoped data access. An attacker with a valid Shopify session token for one `shop` can supply another `shop` in that parameter and potentially obtain unauthorized application data or perform `shop`-scoped actions, depending on the application\u0027s authorization model. This issue is fixed in version 23.0.3."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T22:49:47.431Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Shopify/shopify_app/security/advisories/GHSA-6j52-38f8-qhxr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Shopify/shopify_app/security/advisories/GHSA-6j52-38f8-qhxr"
        },
        {
          "name": "https://github.com/Shopify/shopify_app/pull/2081",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Shopify/shopify_app/pull/2081"
        },
        {
          "name": "https://github.com/Shopify/shopify_app/commit/a09ccc04b9556cbb31c6d56ed81aeb6b9b6c0756",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Shopify/shopify_app/commit/a09ccc04b9556cbb31c6d56ed81aeb6b9b6c0756"
        },
        {
          "name": "https://github.com/Shopify/shopify_app/releases/tag/v23.0.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Shopify/shopify_app/releases/tag/v23.0.3"
        }
      ],
      "source": {
        "advisory": "GHSA-6j52-38f8-qhxr",
        "discovery": "UNKNOWN"
      },
      "title": "Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63414",
    "datePublished": "2026-10-30T22:49:47.431Z",
    "dateReserved": "2026-07-16T19:20:28.988Z",
    "dateUpdated": "2026-11-05T03:01:40.702Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63414",
      "date": "2026-11-05",
      "epss": "0.00749",
      "percentile": "0.5507"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "shopify_app",
                "vendor": "Shopify",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 22.1.0, \u003c 23.0.3"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, `token-exchange` authenticated controllers can expose a request-derived `shop` context instead of the identity from a verified Shopify ID token or active Shopify session. `current_shopify_domain` can resolve to the sanitized `shop` query parameter, so a request authenticated for one `shop` can cause application code to treat a different requested `shop` as current. Affected applications use `shopify_app` `token-exchange` authentication, accept authenticated requests with a `shop` query parameter, and rely on `current_shopify_domain` or `params[:shop]` for authorization, tenant lookup, stored access-token selection or `shop`-scoped data access. An attacker with a valid Shopify session token for one `shop` can supply another `shop` in that parameter and potentially obtain unauthorized application data or perform `shop`-scoped actions, depending on the application\u0027s authorization model. This issue is fixed in version 23.0.3."
          }
        ],
        "id": "CVE-2026-63414",
        "lastModified": "2026-11-05T04:17:12.920",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 7.6,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-63414",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-05T03:01:30.497571Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-30T23:17:15.707",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Shopify/shopify_app/commit/a09ccc04b9556cbb31c6d56ed81aeb6b9b6c0756"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Shopify/shopify_app/pull/2081"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Shopify/shopify_app/releases/tag/v23.0.3"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Shopify/shopify_app/security/advisories/GHSA-6j52-38f8-qhxr"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-863"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-63414",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-11-05T03:01:30.497571Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-11-05T03:01:35.803Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "shopify_app",
              "vendor": "Shopify",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 22.1.0, \u003c 23.0.3"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, `token-exchange` authenticated controllers can expose a request-derived `shop` context instead of the identity from a verified Shopify ID token or active Shopify session. `current_shopify_domain` can resolve to the sanitized `shop` query parameter, so a request authenticated for one `shop` can cause application code to treat a different requested `shop` as current. Affected applications use `shopify_app` `token-exchange` authentication, accept authenticated requests with a `shop` query parameter, and rely on `current_shopify_domain` or `params[:shop]` for authorization, tenant lookup, stored access-token selection or `shop`-scoped data access. An attacker with a valid Shopify session token for one `shop` can supply another `shop` in that parameter and potentially obtain unauthorized application data or perform `shop`-scoped actions, depending on the application\u0027s authorization model. This issue is fixed in version 23.0.3."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "baseScore": 7.6,
                "baseSeverity": "HIGH",
                "privilegesRequired": "LOW",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-863",
                  "description": "CWE-863: Incorrect Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-30T22:49:47.431Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/Shopify/shopify_app/security/advisories/GHSA-6j52-38f8-qhxr",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/Shopify/shopify_app/security/advisories/GHSA-6j52-38f8-qhxr"
            },
            {
              "name": "https://github.com/Shopify/shopify_app/pull/2081",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/Shopify/shopify_app/pull/2081"
            },
            {
              "name": "https://github.com/Shopify/shopify_app/commit/a09ccc04b9556cbb31c6d56ed81aeb6b9b6c0756",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/Shopify/shopify_app/commit/a09ccc04b9556cbb31c6d56ed81aeb6b9b6c0756"
            },
            {
              "name": "https://github.com/Shopify/shopify_app/releases/tag/v23.0.3",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/Shopify/shopify_app/releases/tag/v23.0.3"
            }
          ],
          "source": {
            "advisory": "GHSA-6j52-38f8-qhxr",
            "discovery": "UNKNOWN"
          },
          "title": "Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-63414",
        "datePublished": "2026-10-30T22:49:47.431Z",
        "dateReserved": "2026-07-16T19:20:28.988Z",
        "dateUpdated": "2026-11-05T03:01:40.702Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-63414

Vulnerability from fkie_nvd - Published: 2026-10-30 23:17 - Updated: 2026-11-05 04:17

Severity

7.6 (High) - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/Shopify/shopify_app/commit/a09ccc04b9556cbb31c6d56ed81aeb6b9b6c0756
	security-advisories@github.com	https://github.com/Shopify/shopify_app/pull/2081
	security-advisories@github.com	https://github.com/Shopify/shopify_app/releases/tag/v23.0.3
	security-advisories@github.com	https://github.com/Shopify/shopify_app/security/advisories/GHSA-6j52-38f8-qhxr

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "shopify_app",
          "vendor": "Shopify",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 22.1.0, \u003c 23.0.3"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, `token-exchange` authenticated controllers can expose a request-derived `shop` context instead of the identity from a verified Shopify ID token or active Shopify session. `current_shopify_domain` can resolve to the sanitized `shop` query parameter, so a request authenticated for one `shop` can cause application code to treat a different requested `shop` as current. Affected applications use `shopify_app` `token-exchange` authentication, accept authenticated requests with a `shop` query parameter, and rely on `current_shopify_domain` or `params[:shop]` for authorization, tenant lookup, stored access-token selection or `shop`-scoped data access. An attacker with a valid Shopify session token for one `shop` can supply another `shop` in that parameter and potentially obtain unauthorized application data or perform `shop`-scoped actions, depending on the application\u0027s authorization model. This issue is fixed in version 23.0.3."
    }
  ],
  "id": "CVE-2026-63414",
  "lastModified": "2026-11-05T04:17:12.920",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 7.6,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-63414",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-11-05T03:01:30.497571Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-30T23:17:15.707",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Shopify/shopify_app/commit/a09ccc04b9556cbb31c6d56ed81aeb6b9b6c0756"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Shopify/shopify_app/pull/2081"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Shopify/shopify_app/releases/tag/v23.0.3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Shopify/shopify_app/security/advisories/GHSA-6j52-38f8-qhxr"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-6J52-38F8-QHXR

Vulnerability from github – Published: 2026-10-29 16:39 – Updated: 2026-10-29 16:39

Summary

Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps

Details

In token-exchange authenticated controllers, shopify_app exposes shop context through helpers such as current_shopify_domain. Prior to the fix, current_shopify_domain could resolve to the sanitized shop query parameter instead of the shop identity derived from the verified Shopify ID token or active Shopify session.

As a result, a request authenticated for one shop could include a different shop query parameter, causing application code to treat the requested shop as the current shop.

Applications that used current_shopify_domain, or the request shop parameter, for authorization decisions, tenant lookup, stored access-token selection, or shop-scoped data access may have been vulnerable to cross-shop context confusion.

The patched version hardens token-exchange handling so that: - current_shopify_domain resolves to the authenticated shop from the verified token or session. - authenticated_shopify_domain exposes the trusted authenticated shop. - requested_shopify_domain exposes the sanitized requested shop parameter for bootstrap or routing use cases only. - Token-exchange requests are rejected with 401 Unauthorized when the requested shop does not match the authenticated shop.

Impact

In affected applications, an attacker with a valid Shopify session token for one shop could send an authenticated request that also supplied a different shop query parameter. If the application relied on current_shopify_domain or params[:shop] for security-sensitive shop scoping, application code could operate in the context of the requested shop rather than the authenticated shop.

Affected applications are those that:

Use shopify_app token-exchange authentication;
Accept authenticated controller requests where a shop query parameter may be present; and
Use current_shopify_domain or the request shop parameter for authorization, tenant lookup, stored access-token selection, or shop-scoped resource access.

Depending on the application’s authorization model, this could result in unauthorized access to another shop’s application data or unauthorized shop-scoped actions.

Remediation

Upgrade to shopify_app version 23.0.3

Workarounds

Applications that cannot upgrade immediately should apply equivalent validation in token-exchange authenticated controllers:

Do not use params[:shop] for authorization, tenant lookup, access-token selection, or data scoping.
On vulnerable versions, avoid relying on current_shopify_domain for security-sensitive shop scoping if a shop query parameter may be present.
Use the authenticated shop from the verified ID token or active Shopify session instead, such as current_shopify_session.shop or the verified JWT dest value.
If a sanitized params[:shop] value is present, reject the request with 401 Unauthorized when it does not match the authenticated shop.

Credit

This issue was responsibly reported by Hackerone researcher leqtuer.

Severity

7.6 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "shopify_app"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "22.1.0"
            },
            {
              "fixed": "23.0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-63414"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-29T16:39:49Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "In token-exchange authenticated controllers, `shopify_app` exposes shop context through helpers such as `current_shopify_domain`. Prior to the fix, `current_shopify_domain` could resolve to the sanitized `shop` query parameter instead of the shop identity derived from the verified Shopify ID token or active Shopify session.\n\nAs a result, a request authenticated for one shop could include a different `shop` query parameter, causing application code to treat the requested shop as the current shop.\n\nApplications that used `current_shopify_domain`, or the request `shop` parameter, for authorization decisions, tenant lookup, stored access-token selection, or shop-scoped data access may have been vulnerable to cross-shop context confusion.\n\nThe patched version hardens token-exchange handling so that:\n   - `current_shopify_domain` resolves to the authenticated shop from the verified token or session.\n   - `authenticated_shopify_domain` exposes the trusted authenticated shop.\n   - `requested_shopify_domain` exposes the sanitized requested `shop` parameter for bootstrap or routing use cases only.\n   - Token-exchange requests are rejected with `401 Unauthorized` when the requested shop does not match the authenticated shop.\n\n## Impact\n\nIn affected applications, an attacker with a valid Shopify session token for one shop could send an authenticated request that also supplied a different `shop` query parameter. If the application relied on `current_shopify_domain` or `params[:shop]` for security-sensitive shop scoping, application code could operate in the context of the requested shop rather than the authenticated shop.\n\nAffected applications are those that:\n\n   1. Use `shopify_app` token-exchange authentication;\n   2. Accept authenticated controller requests where a `shop` query parameter may be present; and\n   3. Use `current_shopify_domain` or the request `shop` parameter for authorization, tenant lookup, stored access-token selection, or shop-scoped resource access.\n\nDepending on the application\u2019s authorization model, this could result in unauthorized access to another shop\u2019s application data or unauthorized shop-scoped actions.\n\n## Remediation\nUpgrade to `shopify_app` version `23.0.3`\n\n## Workarounds\nApplications that cannot upgrade immediately should apply equivalent validation in token-exchange authenticated controllers:\n\n- Do not use `params[:shop]` for authorization, tenant lookup, access-token selection, or data scoping.\n- On vulnerable versions, avoid relying on `current_shopify_domain` for security-sensitive shop scoping if a `shop` query parameter may be present.\n- Use the authenticated shop from the verified ID token or active Shopify session instead, such as `current_shopify_session.shop` or the verified JWT `dest` value.\n   - If a sanitized `params[:shop]` value is present, reject the request with `401 Unauthorized` when it does not match the authenticated shop.\n\n## Credit\n\nThis issue was responsibly reported by Hackerone researcher [leqtuer](https://hackerone.com/leqtuer?type=user).",
  "id": "GHSA-6j52-38f8-qhxr",
  "modified": "2026-10-29T16:39:49Z",
  "published": "2026-10-29T16:39:49Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Shopify/shopify_app/security/advisories/GHSA-6j52-38f8-qhxr"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Shopify/shopify_app"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Shopify/shopify_app/releases/tag/v23.0.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-63414 (GCVE-0-2026-63414)

FKIE_CVE-2026-63414

GHSA-6J52-38F8-QHXR

Impact

Remediation

Workarounds

Credit

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour