CVE-2026-63414

Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, token-exchange authenticated controllers can expose a request-derived shop context instead of the identity from a verified Shopify ID token or active Shopify session. currentshopifydomain can resolve to the...

CVE-2026-63414

The Shopify App Rails engine (versions 22.1.0 through 23.0.3 ) contains a vulnerability where token-exchange authenticated controllers can expose a request-derived shop context. Specifically, the current_shopify_domain helper could resolve to a sanitized shop query parameter instead of the identi...

Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps

In token-exchange authenticated controllers, shopifyapp exposes shop context through helpers such as currentshopifydomain. Prior to the fix, currentshopifydomain could resolve to the sanitized shop query parameter instead of the shop identity derived from the verified Shopify ID token or active...

GHSA-6J52-38F8-QHXR Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps

In token-exchange authenticated controllers, shopifyapp exposes shop context through helpers such as currentshopifydomain. Prior to the fix, currentshopifydomain could resolve to the sanitized shop query parameter instead of the shop identity derived from the verified Shopify ID token or active...

PT-2026-133263

Name of the Vulnerable Software and Affected Versions Shopify App versions 22.1.0 through 23.0.2 Description In token-exchange authenticated controllers, the software exposes shop context through helpers such as current shopify domain. The current shopify domain helper can resolve to the sanitize...