High, CVSS 7.6RubyGemsAmendedPublished
Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps
CVE-2026-63414 · GHSA-6j52-38f8-qhxr
- Affected
- RubyGems shopify_app >= 22.1.0, < 23.0.3
- Fixed in
- 23.0.3· Vendor fix available
- Issue
- In token-exchange authenticated controllers, `shopify_app` exposes shop context through helpers such as `current_shopify_domain`. Prior to the fix, `current_shopify_domain` could resolve to the sanitized `shop` query parameter instead of the shop identity derived from the verified Shopify ID token or active Shopify session. As a result, a request authenticated for one shop could include a different `shop` query parameter, causing application code to treat the requested shop as the current shop. Applications that used `current_shopify_domain`, or the request `shop` parameter, for authorization decisions, tenant lookup, stored access-token selection, or shop-scoped data access may have been vulnerable to cross-shop context confusion. The patched version hardens token-exchange handling so that: - `current_shopify_domain` resolves to the authenticated shop from the verified token or session. - `authenticated_shopify_domain` exposes the trusted authenticated shop. -…
Recommended action: Upgrade to 23.0.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.