CVE-2026-63414

A flaw was found in shopifyapp. In token-exchange authentication workflows, the application can resolve the active store context from an unverified request parameter rather than the validated session token. An authenticated remote attacker with a valid session token for one store can exploit this...