Summary
Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps
In token-exchange authenticated controllers, shopify_app exposes shop context through helpers such as current_shopify_domain. Prior to the fix, current_shopify_domain could resolve to the sanitized shop query parameter instead of the shop identity derived from the verified Shopify ID token or active Shopify session.
As a result, a request authenticated for one shop could include a different shop query parameter, causing application code to treat the requested shop as the current shop.
Applications that used current_shopify_domain, or the request shop parameter, for authorization decisions, tenant lookup, stored access-token selection, or shop-scoped data access may have been vulnerable to cross-shop context confusion.
The patched version hardens token-exchange handling so that:
current_shopify_domainresolves to the authenticated shop from the verified token or session.authenticated_shopify_domainexposes the trusted authenticated shop.requested_shopify_domainexposes the sanitized requestedshopparameter for bootstrap or routing use cases only.- Token-exchange requests are rejected with
401 Unauthorizedwhen the requested shop does not match the authenticated shop.
Workarounds
Applications that cannot upgrade immediately should apply equivalent validation in token-exchange authenticated controllers:
- Do not use
params[:shop]for authorization, tenant lookup, access-token selection, or data scoping. - On vulnerable versions, avoid relying on
current_shopify_domainfor security-sensitive shop scoping if ashopquery parameter may be present. - Use the authenticated shop from the verified ID token or active Shopify session instead, such as
current_shopify_session.shopor the verified JWTdestvalue.- If a sanitized
params[:shop]value is present, reject the request with401 Unauthorizedwhen it does not match the authenticated shop.
- If a sanitized
Credit
This issue was responsibly reported by Hackerone researcher leqtuer.
Impact
In affected applications, an attacker with a valid Shopify session token for one shop could send an authenticated request that also supplied a different shop query parameter. If the application relied on current_shopify_domain or params[:shop] for security-sensitive shop scoping, application code could operate in the context of the requested shop rather than the authenticated shop.
Affected applications are those that:
- Use
shopify_apptoken-exchange authentication; - Accept authenticated controller requests where a
shopquery parameter may be present; and - Use
current_shopify_domainor the requestshopparameter for authorization, tenant lookup, stored access-token selection, or shop-scoped resource access.
Depending on the application’s authorization model, this could result in unauthorized access to another shop’s application data or unauthorized shop-scoped actions.
The application does not correctly enforce access controls, allowing a principal to access resources or operations beyond their granted permissions. Typical impact: unauthorized data access or execution of privileged operations.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Upgrade to shopify_app version 23.0.3
Frequently Asked Questions
- What is CVE-2026-63414? CVE-2026-63414 is a high-severity incorrect authorization vulnerability in shopify_app (rubygems), affecting versions >= 22.1.0, < 23.0.3. It is fixed in 23.0.3. The application does not correctly enforce access controls, allowing a principal to access resources or operations beyond their granted permissions.
- Which versions of shopify_app are affected by CVE-2026-63414? shopify_app (rubygems) versions >= 22.1.0, < 23.0.3 is affected.
- Is there a fix for CVE-2026-63414? Yes. CVE-2026-63414 is fixed in 23.0.3. Upgrade to this version or later.
- Is CVE-2026-63414 exploitable, and should I be worried? Whether CVE-2026-63414 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-63414 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-63414? Upgrade
shopify_appto 23.0.3 or later.