CVE-2026-63414— Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps

Quick assessment

Affected

Shopify shopify_app

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Shopify App 是一个用于构建 Shopify 应用的 Rails 引擎。在版本 22.1.0 至 23.0.3 期间，使用进行身份验证的控制器可能会暴露基于请求参数推导出的上下文，而非来自已验证的 Shopify ID 令牌或当前 Shopify 会话的真实身份。方法可能解析为经过净化的查询参数，导致原本针对某个身份验证的请求，使应用代码将另一个请求中的视为当前商店。受影响的应用程序需同时满足以下条件：使用的身份验证机制；接受带有查询参数的已认证请求；并依赖或进行授权、租户查找、存

CVSS 7.6 · High Updated Oct 31, 2026

Possible ATT&CK Techniques 2 AI

T1201 · Password Policy Discovery T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps

Source: CVE Program / CVE List V5

Vulnerability Description

Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, `token-exchange` authenticated controllers can expose a request-derived `shop` context instead of the identity from a verified Shopify ID token or active Shopify session. `current_shopify_domain` can resolve to the sanitized `shop` query parameter, so a request authenticated for one `shop` can cause application code to treat a different requested `shop` as current. Affected applications use `shopify_app` `token-exchange` authentication, accept authenticated requests with a `shop` query parameter, and rely on `current_shopify_domain` or `params[:shop]` for authorization, tenant lookup, stored access-token selection or `shop`-scoped data access. An attacker with a valid Shopify session token for one `shop` can supply another `shop` in that parameter and potentially obtain unauthorized application data or perform `shop`-scoped actions, depending on the application's authorization model. This issue is fixed in version 23.0.3.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制不正确

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Shopify	shopify_app	>= 22.1.0, < 23.0.3	-

II. Public POCs for CVE-2026-63414

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-63414

请登录查看更多情报信息。

Other References for CVE-2026-63414 (4)

https://github.com/Shopify/shopify_app/pull/2081 x_refsource_MISC
https://github.com/Shopify/shopify_app/releases/tag/v23.0.3 x_refsource_MISC
https://github.com/Shopify/shopify_app/security/advisories/GHSA-6j52-38f8-qhxr x_refsource_CONFIRM
https://github.com/Shopify/shopify_app/commit/a09ccc04b9556cbb31c6d56ed81aeb6b9b6c0756 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-63414

IV. Related Vulnerabilities

Same vendor: Shopify

Same weakness: CWE-863