{"id":"GHSA-6j52-38f8-qhxr","aliases":["CVE-2026-63414"],"title":"Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"HIGH","description":"In token-exchange authenticated controllers, `shopify_app` exposes shop context through helpers such as `current_shopify_domain`. Prior to the fix, `current_shopify_domain` could resolve to the sanitized `shop` query parameter instead of the shop identity derived from the verified Shopify ID token or active Shopify session.\n\nAs a result, a request authenticated for one shop could include a different `shop` query parameter, causing application code to treat the requested shop as the current shop.\n\nApplications that used `current_shopify_domain`, or the request `shop` parameter, for authorization decisions, tenant lookup, stored access-token selection, or shop-scoped data access may have been vulnerable to cross-shop context confusion.\n\nThe patched version hardens token-exchange handling so that:\n   - `current_shopify_domain` resolves to the authenticated shop from the verified token or session.\n   - `authenticated_shopify_domain` exposes the trusted authenticated shop.\n   - `requested_shopify_domain` exposes the sanitized requested `shop` parameter for bootstrap or routing use cases only.\n   - Token-exchange requests are rejected with `401 Unauthorized` when the requested shop does not match the authenticated shop.\n\n## Impact\n\nIn affected applications, an attacker with a valid Shopify session token for one shop could send an authenticated request that also supplied a different `shop` query parameter. If the application relied on `current_shopify_domain` or `params[:shop]` for security-sensitive shop scoping, application code could operate in the context of the requested shop rather than the authenticated shop.\n\nAffected applications are those that:\n\n   1. Use `shopify_app` token-exchange authentication;\n   2. Accept authenticated controller requests where a `shop` query parameter may be present; and\n   3. Use `current_shopify_domain` or the request `shop` parameter for authorization, tenant lookup, stored access-token selection, or shop-scoped resource access.\n\nDepending on the application’s authorization model, this could result in unauthorized access to another shop’s application data or unauthorized shop-scoped actions.\n\n## Remediation\nUpgrade to `shopify_app` version `23.0.3`\n\n## Workarounds\nApplications that cannot upgrade immediately should apply equivalent validation in token-exchange authenticated controllers:\n\n- Do not use `params[:shop]` for authorization, tenant lookup, access-token selection, or data scoping.\n- On vulnerable versions, avoid relying on `current_shopify_domain` for security-sensitive shop scoping if a `shop` query parameter may be present.\n- Use the authenticated shop from the verified ID token or active Shopify session instead, such as `current_shopify_session.shop` or the verified JWT `dest` value.\n   - If a sanitized `params[:shop]` value is present, reject the request with `401 Unauthorized` when it does not match the authenticated shop.\n\n## Credit\n\nThis issue was responsibly reported by Hackerone researcher [leqtuer](https://hackerone.com/leqtuer?type=user).","severity":"high","score":7.6,"published":"2026-10-29T16:39:49.000Z","modified":"2026-10-30T22:49:47.431Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"RubyGems","name":"shopify_app","sources":[{"name":"OSV · GHSA-6j52-38f8-qhxr","url":"https://osv.dev/vulnerability/GHSA-6j52-38f8-qhxr"}],"ranges":[{"events":[{"introduced":"22.1.0"},{"fixed":"23.0.3"}],"type":"ECOSYSTEM"}],"versions":["22.1.0","22.2.0","22.2.1","22.3.0","22.3.1","22.4.0","22.5.0","22.5.1","22.5.2","23.0.0","23.0.1","23.0.2"],"fixed":["23.0.3"]}],"sourceAffected":[],"references":["https://github.com/Shopify/shopify_app/security/advisories/GHSA-6j52-38f8-qhxr","https://github.com/Shopify/shopify_app","https://github.com/Shopify/shopify_app/releases/tag/v23.0.3","https://github.com/Shopify/shopify_app/pull/2081","https://github.com/Shopify/shopify_app/commit/a09ccc04b9556cbb31c6d56ed81aeb6b9b6c0756"],"sources":[{"name":"OSV","id":"GHSA-6j52-38f8-qhxr","modified":"2026-10-29T16:45:05.328073736Z","url":"https://osv.dev/vulnerability/GHSA-6j52-38f8-qhxr"},{"name":"CVE","id":"CVE-2026-63414","modified":"2026-10-30T22:49:47.431Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-63414"}],"assessments":[{"source":"OSV","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","score":7.6},{"source":"GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","score":7.6}],"cve":{"records":[{"id":"CVE-2026-63414","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-07-16T19:20:28.988Z","published":"2026-10-30T22:49:47.431Z","modified":"2026-10-30T22:49:47.431Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-30T22:49:47.431Z"}],"references":[{"url":"https://github.com/Shopify/shopify_app/security/advisories/GHSA-6j52-38f8-qhxr","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/Shopify/shopify_app/pull/2081","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/Shopify/shopify_app/commit/a09ccc04b9556cbb31c6d56ed81aeb6b9b6c0756","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/Shopify/shopify_app/releases/tag/v23.0.3","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-863","description":"CWE-863: Incorrect Authorization","source":"GitHub_M"}],"applicability":[],"prioritization":[]},"products":[{"vendor":"Shopify","name":"shopify_app","platforms":[],"versions":[{"version":">= 22.1.0, < 23.0.3","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-63414"}],"remediation":[],"observedAt":"2026-10-31T00:00:17.538Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T04:30:32.141Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-10-29T17:05:37.234Z","attemptedAt":"2026-10-29T17:05:37.234Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-29T17:05:37.305Z","attemptedAt":"2026-10-29T17:05:37.305Z"},{"source":"EUVD","status":"refresh-failed","attemptedAt":"2026-10-29T17:05:36.438Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-29T17:05:37.302Z","attemptedAt":"2026-10-29T17:05:37.302Z"}],"evidence":[{"source":"GitHub Advisory Database","id":"GHSA-6j52-38f8-qhxr","url":"https://github.com/advisories/GHSA-6j52-38f8-qhxr","modified":"2026-10-29T16:39:49Z","checkedAt":"2026-10-29T17:05:37.305Z"}],"aiSummary":null}