---
id: "CVE-2026-63414"
kind: "vulnerability"
aliases: ["CVE-2026-63414", "GHSA-6j52-38f8-qhxr"]
title: "Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "shopify_app", "fixed": ["23.0.3"], "affected": ">= 22.1.0, < 23.0.3", "ecosystem": "rubygems"}]
ecosystems: ["rubygems"]
tags: ["cwe-863", "package", "rails", "ruby", "shopify", "shopify-app"]
not_affected_if: ["not-token-exchange", "uses-session-shop-only", "version-23.0.3-or-later"]
published_at: "2026-10-29T16:39:49+00:00"
first_seen_at: "2026-10-29T16:44:11+00:00"
updated_at: "2026-10-29T16:46:01+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-6j52-38f8-qhxr", "first_seen_at": "2026-10-29T16:44:11+00:00"}]
---

# Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps

The shopify_app Ruby gem's token-exchange controllers could resolve the current shop from a request's shop query parameter instead of the verified Shopify token or session. An attacker holding a valid session for one shop can act on another shop's data by supplying a different shop parameter.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- rubygems:shopify_app affected >= 22.1.0, < 23.0.3 fixed 23.0.3

## How to check

- Check the installed version: `bundle exec gem list shopify_app` or inspect Gemfile.lock for `shopify_app`.
- Search application code for uses of `current_shopify_domain` or `params[:shop]` in authorization, tenant lookup, or access-token selection.
- Confirm whether token-exchange authentication is used in the app.

## Fix

- `shopify_app` `23.0.3` (affected range: `>= 22.1.0, < 23.0.3`)

## Timeline

- 2026-10-29T16:44:11+00:00 ghsa https://github.com/advisories/GHSA-6j52-38f8-qhxr

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/Shopify/shopify_app/security-advisories/GHSA-6j52-38f8-qhxr
- [advisory] Maintainer's advisory: github.com https://github.com/Shopify/shopify_app/security/advisories/GHSA-6j52-38f8-qhxr
- [fix] Release: github.com https://github.com/Shopify/shopify_app/releases/tag/v23.0.3

## From the sources

In token-exchange authenticated controllers, `shopify_app` exposes shop context through helpers such as `current_shopify_domain`. Prior to the fix, `current_shopify_domain` could resolve to the sanitized `shop` query parameter instead of the shop identity derived from the verified Shopify ID token or active Shopify session.

As a result, a request authenticated for one shop could include a different `shop` query parameter, causing application code to treat the requested shop as the current shop.

Applications that used `current_shopify_domain`, or the request `shop` parameter, for authorization decisions, tenant lookup, stored access-token selection, or shop-scoped data access may have been vulnerable to cross-shop context confusion.

The patched version hardens token-exchange handling so that:
   - `current_shopify_domain` resolves to the authenticated shop from the verified token or session.
   - `authenticated_shopify_domain` exposes the trusted authenticated shop.
   - `requested_shopify_domain` exposes the sanitized requested `shop` parameter for bootstrap or routing use cases only.
   - Token-exchange requests are rejected with `401 Unauthorized` when the requested shop does not match the authenticated shop.

## Impact

In affected applications, an attacker with a valid Shopify session token for one shop could send an authenticated request that also supplied a different `shop` query parameter. If the application relied on `current_shopify_domain` or `params[:shop]` for security-sensitive shop scoping, application code could operate in the context of the requested shop rather than the authenticated shop.

Affected applications are those that:

   1. Use `shopify_app` token-exchange authentication;
   2. Accept authenticated controller requests where a `shop` query parameter may be present; and
   3. Use `current_shopify_domain` or the request `shop` parameter for authorization, tenant lookup, stored access-token selection, or shop-scoped resource access.

Depending on the application’s authorization model, this could result in unauthorized access to another shop’s application data or unauthorized shop-scoped actions.

## Remediation
Upgrade to `shopify_app` version `23.0.3`

## Workarounds
Applications that cannot upgrade immediately should apply equivalent validation in token-exchange authenticated controllers:

- Do not use `params[:shop]` for authorization, tenant lookup, access-token selection, or data scoping.
- On vulnerable versions, avoid relying on `current_shopify_domain` for security-sensitive shop scoping if a `shop` query parameter may be present.
- Use the authenticated shop from the verified ID token or active Shopify session instead, such as `current_shopify_session.shop` or the verified JWT `dest` value.
   - If a sanitized `params[:shop]` value is present, reject the request with `401 Unauthorized` when it does not match the authenticated shop.

## Credit

This issue was responsibly reported by Hackerone researcher [leqtuer](https://hackerone.com/leqtuer?type=user).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_