CVE-2026-63414

Received Received - Intake

Shopify App Token Exchange Shop Context Exposure

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: GitHub, Inc.

Description

Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, `token-exchange` authenticated controllers can expose a request-derived `shop` context instead of the identity from a verified Shopify ID token or active Shopify session. `current_shopify_domain` can resolve to the sanitized `shop` query parameter, so a request authenticated for one `shop` can cause application code to treat a different requested `shop` as current. Affected applications use `shopify_app` `token-exchange` authentication, accept authenticated requests with a `shop` query parameter, and rely on `current_shopify_domain` or `params[:shop]` for authorization, tenant lookup, stored access-token selection or `shop`-scoped data access. An attacker with a valid Shopify session token for one `shop` can supply another `shop` in that parameter and potentially obtain unauthorized application data or perform `shop`-scoped actions, depending on the application's authorization model. This issue is fixed in version 23.0.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-30

Last Modified

2026-10-30

Generated

2026-10-31

AI Q&A

2026-10-31

EPSS Evaluated

N/A

NVD

CVE-2026-63414

Affected Vendors & Products

Vendor	Product	Version / Range
Shopify	shopify_app	>= 22.1.0, < 23.0.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability affects Shopify App, a Rails engine for building Shopify applications. Between versions 22.1.0 and 23.0.3, authenticated controllers using token-exchange can expose a request-derived shop context instead of the verified shop identity from a Shopify ID token or active session. The current_shopify_domain method may resolve to a sanitized shop query parameter, allowing an attacker with a valid session for one shop to supply a different shop and potentially access unauthorized data or perform actions.

Detection Guidance

Check if your Shopify app uses token-exchange authentication and accepts a shop query parameter. Review application logs for requests with mismatched shop domains in tokens and query parameters. Inspect code for use of current_shopify_domain or params[:shop] in authorization logic.

Impact Analysis

An attacker with a valid Shopify session token for one shop can manipulate the shop query parameter to access data or perform actions on another shop. This depends on the application's authorization model but could lead to unauthorized data exposure or actions if the app relies on current_shopify_domain or params[:shop] for authorization or tenant lookup.

Mitigation Strategies

Upgrade shopify_app to version 23.0.3 or later. Ensure current_shopify_domain and params[:shop] are validated against the authenticated shop from the Shopify ID token. Disable token-exchange authentication if not required.

Hi! I’m here to help you understand CVE-2026-63414. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70