CVE-2026-63414 Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps

Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, token-exchange authenticated controllers can expose a request-derived shop context instead of the identity from a verified Shopify ID token or active Shopify session. currentshopifydomain can resolve to the...

CVE-2026-63414

Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, "token-exchange" authenticated controllers can expose a request-derived "shop" context instead of the identity from a verified Shopify ID token or active Shopify session. "currentshopifydomain" can resolve ...

Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps

In token-exchange authenticated controllers, shopifyapp exposes shop context through helpers such as currentshopifydomain. Prior to the fix, currentshopifydomain could resolve to the sanitized shop query parameter instead of the shop identity derived from the verified Shopify ID token or active...

GHSA-6J52-38F8-QHXR Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps

In token-exchange authenticated controllers, shopifyapp exposes shop context through helpers such as currentshopifydomain. Prior to the fix, currentshopifydomain could resolve to the sanitized shop query parameter instead of the shop identity derived from the verified Shopify ID token or active...

PT-2026-133263

Name of the Vulnerable Software and Affected Versions Shopify App versions 22.1.0 through 23.0.2 Description In token-exchange authenticated controllers, the software exposes shop context through helpers such as current shopify domain. The current shopify domain helper can resolve to the sanitize...

PT-2026-133238

In token-exchange authenticated controllers, shopify app exposes shop context through helpers such as current shopify domain. Prior to the fix, current shopify domain could resolve to the sanitized shop query parameter instead of the shop identity derived from the verified Shopify ID token or...

PT-2026-105910

Impact The Vend OAuth2 backend used only the numeric Vend user id as the social-auth UID. When multiple Vend shops authenticate through the same application, users from different shops with the same internal Vend user ID could collide in the social-auth association table. A user from one shop cou...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication in the currentshopifydomain helper. An attacker can gain unauthorized access to resources belonging to a different shop by sending a request authenticated for one shop while including a different shop in the quer...

Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps

Description In token-exchange authenticated controllers, shopifyapp exposes shop context through helpers such as currentshopifydomain. Prior to the fix, currentshopifydomain could resolve to the sanitized shop query parameter instead of the shop identity derived from the verified Shopify ID token...