HIGH GitHub
CVE-2026-63414
Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps
In token-exchange authenticated controllers, `shopify_app` exposes shop context through helpers such as `current_shopify_domain`. Prior to the fix, `current_shopify_domain` could resolve to the sanitized `shop` query parameter instead of the shop identity derived from the verified Shopify ID token or active Shopify session.
As a result, a request authenticated for one shop could include a different `shop` query parameter, causing application code to treat the requested shop as the current shop.
Affected Products
- rubygems/shopify_app >= 22.1.0, < 23.0.3
References
- https://github.com/advisories/GHSA-6j52-38f8-qhxr
- https://github.com/Shopify/shopify_app/security/advisories/GHSA-6j52-38f8-qhxr
- https://github.com/Shopify/shopify_app/releases/tag/v23.0.3
- https://github.com/advisories/GHSA-6j52-38f8-qhxr
This high severity vulnerability was published on 2026-10-29 via GitHub. Affected: rubygems/shopify_app >= 22.1.0, < 23.0.3.
vulnfeed aggregates 16884 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.