{"id":"CVE-2026-63414","kind":"vulnerability","aliases":["CVE-2026-63414","GHSA-6j52-38f8-qhxr"],"related":[],"title":"Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps","description":"In token-exchange authenticated controllers, `shopify_app` exposes shop context through helpers such as `current_shopify_domain`. Prior to the fix, `current_shopify_domain` could resolve to the sanitized `shop` query parameter instead of the shop identity derived from the verified Shopify ID token or active Shopify session.\n\nAs a result, a request authenticated for one shop could include a different `shop` query parameter, causing application code to treat the requested shop as the current shop.\n\nApplications that used `current_shopify_domain`, or the request `shop` parameter, for authorization decisions, tenant lookup, stored access-token selection, or shop-scoped data access may have been vulnerable to cross-shop context confusion.\n\nThe patched version hardens token-exchange handling so that:\n   - `current_shopify_domain` resolves to the authenticated shop from the verified token or session.\n   - `authenticated_shopify_domain` exposes the trusted authenticated shop.\n   - `requested_shopify_domain` exposes the sanitized requested `shop` parameter for bootstrap or routing use cases only.\n   - Token-exchange requests are rejected with `401 Unauthorized` when the requested shop does not match the authenticated shop.\n\n## Impact\n\nIn affected applications, an attacker with a valid Shopify session token for one shop could send an authenticated request that also supplied a different `shop` query parameter. If the application relied on `current_shopify_domain` or `params[:shop]` for security-sensitive shop scoping, application code could operate in the context of the requested shop rather than the authenticated shop.\n\nAffected applications are those that:\n\n   1. Use `shopify_app` token-exchange authentication;\n   2. Accept authenticated controller requests where a `shop` query parameter may be present; and\n   3. Use `current_shopify_domain` or the request `shop` parameter for authorization, tenant lookup, stored access-token selection, or shop-scoped resource access.\n\nDepending on the application’s authorization model, this could result in unauthorized access to another shop’s application data or unauthorized shop-scoped actions.\n\n## Remediation\nUpgrade to `shopify_app` version `23.0.3`\n\n## Workarounds\nApplications that cannot upgrade immediately should apply equivalent validation in token-exchange authenticated controllers:\n\n- Do not use `params[:shop]` for authorization, tenant lookup, access-token selection, or data scoping.\n- On vulnerable versions, avoid relying on `current_shopify_domain` for security-sensitive shop scoping if a `shop` query parameter may be present.\n- Use the authenticated shop from the verified ID token or active Shopify session instead, such as `current_shopify_session.shop` or the verified JWT `dest` value.\n   - If a sanitized `params[:shop]` value is present, reject the request with `401 Unauthorized` when it does not match the authenticated shop.\n\n## Credit\n\nThis issue was responsibly reported by Hackerone researcher [leqtuer](https://hackerone.com/leqtuer?type=user).","summary":"The shopify_app Ruby gem's token-exchange controllers could resolve the current shop from a request's shop query parameter instead of the verified Shopify token or session. An attacker holding a valid session for one shop can act on another shop's data by supplying a different shop parameter.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"shopify_app","fixed":["23.0.3"],"affected":">= 22.1.0, < 23.0.3","ecosystem":"rubygems"}],"ecosystems":["rubygems"],"tags":["cwe-863","package","rails","ruby","shopify","shopify-app"],"not_affected_if":["not-token-exchange","uses-session-shop-only","version-23.0.3-or-later"],"how_to_check":"- Check the installed version: `bundle exec gem list shopify_app` or inspect Gemfile.lock for `shopify_app`.\n- Search application code for uses of `current_shopify_domain` or `params[:shop]` in authorization, tenant lookup, or access-token selection.\n- Confirm whether token-exchange authentication is used in the app.","fix":"- `shopify_app` `23.0.3` (affected range: `>= 22.1.0, < 23.0.3`)","status":"open","published_at":"2026-10-29T16:39:49+00:00","first_seen_at":"2026-10-29T16:44:11+00:00","triaged_at":"2026-10-29T16:46:01+00:00","updated_at":"2026-10-29T16:46:01+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-29T16:46:01Z","model":"claude-haiku-5-5","output":{"fix":"- `shopify_app` `23.0.3` (affected range: `>= 22.1.0, < 23.0.3`)","reach":"internet","title":"Shopify App: shop context confusion allows cross-shop authorization bypass","impact":"high","summary":"The shopify_app Ruby gem's token-exchange controllers could resolve the current shop from a request's shop query parameter instead of the verified Shopify token or session. An attacker holding a valid session for one shop can act on another shop's data by supplying a different shop parameter.","audience":"developers","category":"package","nicknames":[],"who_cares":["shopify","ruby","rails","shopify-app"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads or changes another shop's data via authenticated requests.","analyst_note":"","how_to_check":"- Check the installed version: `bundle exec gem list shopify_app` or inspect Gemfile.lock for `shopify_app`.\n- Search application code for uses of `current_shopify_domain` or `params[:shop]` in authorization, tenant lookup, or access-token selection.\n- Confirm whether token-exchange authentication is used in the app.","plain_action":"","needs_analyst":false,"not_affected_if":["not-token-exchange","uses-session-shop-only","version-23.0.3-or-later"],"who_is_affected":"Apps that use shopify_app token-exchange authentication and rely on current_shopify_domain or the request shop parameter for authorization, tenant lookup, stored token selection, or shop-scoped data access. Apps that only use the verified session shop, or that do not use token exchange, are not described as exposed. Applications that cannot upgrade should reject requests whose sanitized shop parameter does not match the authenticated shop.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000839,"input_tokens":5128,"output_tokens":652,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':19A,27A '-63414':20A,28A '-863':32B '/leqtuer?type=user).':530C '1':339C '2':347C '23.0.3':417C '3':361C '38f8':24A '401':261C,508C '6j52':23A 'accept':348C 'access':187C,195C,377C,385C,398C,444C 'access-token':186C,376C,443C 'act':80B 'action':410C 'activ':138C,483C 'affect':16A,275C,334C 'allow':9A 'also':294C 'anoth':82B,400C 'app':2A,17A,30A,39B,42B,99C,342C,415C 'appli':425C 'applic':158C,169C,276C,303C,318C,335C,389C,403C,419C 'attack':71B,278C 'authent':96C,146C,222C,230C,236C,271C,291C,332C,346C,349C,432C,475C,516C 'author':13A,181C,372C,391C,440C 'avoid':453C 'bootstrap':248C 'bypass':14A 'cannot':421C 'case':252C 'caus':157C 'code':159C,319C 'confus':7A,205C 'context':6A,102C,204C,324C 'control':49B,97C,350C,433C 'could':50B,117C,150C,288C,320C,394C 'credit':518C 'cross':11A,202C 'cross-shop':10A,201C 'current':53B,107C,114C,167C,172C,216C,306C,363C,456C 'current_shopify_session.shop':489C 'cve':18A,26A 'cwe':31B 'data':85B,194C,404C,448C 'decis':182C 'depend':386C 'deriv':130C 'dest':494C 'differ':89B,153C,297C 'domain':109C,116C,174C,218C,232C,240C,308C,365C,458C 'equival':426C 'exchang':4A,48B,95C,212C,256C,345C,431C 'expos':100C,233C,241C 'fix':113C 'gem':44B 'ghsa':22A 'ghsa-6j52-38f8-qhxr':21A 'hackeron':525C 'hackerone.com':529C 'hackerone.com/leqtuer?type=user).':528C 'handl':213C 'harden':209C 'helper':104C 'hold':72B 'id':135C,480C 'ident':129C 'immedi':423C 'impact':273C 'includ':151C 'instead':62B,125C,486C 'issu':520C 'jwt':493C 'leqtuer':527C 'lookup':184C,374C,442C 'match':269C,514C 'may':8A,196C,357C,470C 'model':392C 'one':77B,148C,286C 'oper':321C 'packag':33B 'param':310C,437C,499C 'paramet':61B,91B,124C,156C,179C,246C,300C,356C,370C,469C 'patch':207C 'present':359C,472C,503C 'prior':110C 'qhxr':25A 'queri':60B,123C,155C,299C,355C,468C 'rail':34B 'rather':329C 'reject':259C,504C 'reli':304C,454C 'remedi':411C 'report':523C 'request':57B,145C,163C,177C,238C,244C,257C,265C,292C,327C,351C,368C,506C 'research':526C 'resolv':51B,118C,219C 'resourc':384C 'respons':522C 'result':143C,395C 'rout':250C 'rubi':35B,43B 'sanit':121C,243C,498C 'scope':193C,317C,383C,409C,449C,464C 'secur':314C,461C 'security-sensit':313C,460C 'select':189C,379C,446C 'send':289C 'sensit':315C,462C 'session':69B,75B,140C,229C,283C,485C 'shop':5A,12A,54B,59B,78B,83B,90B,101C,122C,128C,149C,154C,164C,168C,178C,192C,203C,223C,237C,245C,266C,272C,287C,298C,311C,316C,328C,333C,354C,369C,382C,401C,408C,438C,463C,467C,476C,500C,517C 'shop-scop':191C,381C,407C 'shopifi':1A,36B,38B,41B,66B,98C,108C,115C,134C,139C,173C,217C,231C,239C,282C,307C,341C,364C,414C,457C,484C 'shopify':29A 'shopify-app':37B 'store':185C,375C 'suppli':87B,295C 'tenant':183C,373C,441C 'token':3A,47B,67B,94C,136C,188C,211C,227C,255C,284C,344C,378C,430C,445C,481C 'token-exchang':46B,93C,210C,254C,343C,429C 'treat':161C 'trust':235C 'unauthor':262C,397C,406C,509C 'upgrad':412C,422C 'use':171C,251C,340C,362C,436C,473C 'valid':74B,281C,427C 'valu':495C,501C 'verifi':65B,133C,226C,479C,492C 'version':208C,416C,452C 'vulner':199C,451C 'workaround':418C","nicknames":[],"mitigations":[],"who_affected":"Apps that use shopify_app token-exchange authentication and rely on current_shopify_domain or the request shop parameter for authorization, tenant lookup, stored token selection, or shop-scoped data access. Apps that only use the verified session shop, or that do not use token exchange, are not described as exposed. Applications that cannot upgrade should reject requests whose sanitized shop parameter does not match the authenticated shop.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T16:39:49+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-6j52-38f8-qhxr","url":"https://github.com/advisories/GHSA-6j52-38f8-qhxr","severity":"high","published_at":"2026-10-29T16:39:49+00:00","modified_at":"2026-10-29T16:39:49+00:00","first_seen_at":"2026-10-29T16:44:11+00:00","fetched_at":"2026-10-29T16:44:11+00:00","note":null}],"documents":[{"id":17889,"url":"https://api.github.com/repos/Shopify/shopify_app/security-advisories/GHSA-6j52-38f8-qhxr","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":17890,"url":"https://github.com/Shopify/shopify_app/security/advisories/GHSA-6j52-38f8-qhxr","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":17891,"url":"https://github.com/Shopify/shopify_app/releases/tag/v23.0.3","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}