CVE-2026-63414

The Shopify App Rails engine (versions 22.1.0 through 23.0.3 ) contains a vulnerability where token-exchange authenticated controllers can expose a request-derived shop context. Specifically, the current_shopify_domain helper could resolve to a sanitized shop query parameter instead of the identi...