CVE-2026-63414

Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, token-exchange authenticated controllers can expose a request-derived shop context instead of the identity from a verified Shopify ID token or active Shopify session. current_shopify_domain can resolve to the sanitized shop query parameter, so a request authenticated for one shop can cause application code to treat a different requested shop as current. Affected applications use shopify_app token-exchange authentication, accept authenticated requests with a shop query parameter, and rely on current_shopify_domain or params[:shop] for authorization, tenant lookup, stored access-token selection or shop-scoped data access. An attacker with a valid Shopify session token for one shop can supply another shop in that parameter and potentially obtain unauthorized application data or perform shop-scoped actions, depending on the application's authorization model. This issue is fixed in version 23.0.3.

Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, token-exchange authenticated controllers can expose a request-derived shop context instead of the identity from a verified Shopify ID token or active Shopify session. current_shopify_domain can resolve to the sanitized shop query parameter, so a request authenticated for one shop can cause application code to treat a different requested shop as current. Affected applications use shopify_app token-exchange authentication, accept authenticated requests with a shop query parameter, and rely on current_shopify_domain or params[:shop] for authorization, tenant lookup, stored access-token selection or shop-scoped data access. An attacker with a valid Shopify session token for one shop can supply another shop in that parameter and potentially obtain unauthorized application data or perform shop-scoped actions, depending on the application's authorization model. This issue is fixed in version 23.0.3.

In token-exchange authenticated controllers, shopify_app exposes shop context through helpers such as current_shopify_domain. Prior to the fix, current_shopify_domain could resolve to the sanitized shop query parameter instead of the shop identity derived from the verified Shopify ID token or active Shopify session.

As a result, a request authenticated for one shop could include a different shop query parameter, causing application code to treat the requested shop as the current shop.

Applications that used current_shopify_domain, or the request shop parameter, for authorization decisions, tenant lookup, stored access-token selection, or shop-scoped data access may have been vulnerable to cross-shop context confusion.

The patched version hardens token-exchange handling so that:

• current_shopify_domain resolves to the authenticated shop from the verified token or session.
• authenticated_shopify_domain exposes the trusted authenticated shop.
• requested_shopify_domain exposes the sanitized requested shop parameter for bootstrap or routing use cases only.
• Token-exchange requests are rejected with 401 Unauthorized when the requested shop does not match the authenticated shop.

Impact

In affected applications, an attacker with a valid Shopify session token for one shop could send an authenticated request that also supplied a different shop query parameter. If the application relied on current_shopify_domain or params[:shop] for security-sensitive shop scoping, application code could operate in the context of the requested shop rather than the authenticated shop.

Affected applications are those that:

1. Use shopify_app token-exchange authentication;
2. Accept authenticated controller requests where a shop query parameter may be present; and
3. Use current_shopify_domain or the request shop parameter for authorization, tenant lookup, stored access-token selection, or shop-scoped resource access.

Depending on the application’s authorization model, this could result in unauthorized access to another shop’s application data or unauthorized shop-scoped actions.

Remediation

Upgrade to shopify_app version 23.0.3

Workarounds

Applications that cannot upgrade immediately should apply equivalent validation in token-exchange authenticated controllers:

• Do not use params[:shop] for authorization, tenant lookup, access-token selection, or data scoping.
• On vulnerable versions, avoid relying on current_shopify_domain for security-sensitive shop scoping if a shop query parameter may be present.
• Use the authenticated shop from the verified ID token or active Shopify session instead, such as current_shopify_session.shop or the verified JWT dest value.
  • If a sanitized params[:shop] value is present, reject the request with 401 Unauthorized when it does not match the authenticated shop.

Credit

This issue was responsibly reported by Hackerone researcher leqtuer.

Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, token-exchange authenticated controllers can expose a request-derived shop context instead of the identity from a verified Shopify ID token or active Shopify session. current_shopify_domain can resolve to the sanitized shop query parameter, so a request authenticated for one shop can cause application code to treat a different requested shop as current. Affected applications use shopify_app token-exchange authentication, accept authenticated requests with a shop query parameter, and rely on current_shopify_domain or params[:shop] for authorization, tenant lookup, stored access-token selection or shop-scoped data access. An attacker with a valid Shopify session token for one shop can supply another shop in that parameter and potentially obtain unauthorized application data or perform shop-scoped actions, depending on the application's authorization model. This issue is fixed in version 23.0.3.

Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, token-exchange authenticated controllers can expose a request-derived shop context instead of the identity from a verified Shopify ID token or active Shopify session. current_shopify_domain can resolve to the sanitized shop query parameter, so a request authenticated for one shop can cause application code to treat a different requested shop as current. Affected applications use shopify_app token-exchange authentication, accept authenticated requests with a shop query parameter, and rely on current_shopify_domain or params[:shop] for authorization, tenant lookup, stored access-token selection or shop-scoped data access. An attacker with a valid Shopify session token for one shop can supply another shop in that parameter and potentially obtain unauthorized application data or perform shop-scoped actions, depending on the application's authorization model. This issue is fixed in version 23.0.3.

In token-exchange authenticated controllers, shopify_app exposes shop context through helpers such as current_shopify_domain. Prior to the fix, current_shopify_domain could resolve to the sanitized shop query parameter instead of the shop identity derived from the verified Shopify ID token or active Shopify session.

As a result, a request authenticated for one shop could include a different shop query parameter, causing application code to treat the requested shop as the current shop.

Applications that used current_shopify_domain, or the request shop parameter, for authorization decisions, tenant lookup, stored access-token selection, or shop-scoped data access may have been vulnerable to cross-shop context confusion.

The patched version hardens token-exchange handling so that:

• current_shopify_domain resolves to the authenticated shop from the verified token or session.
• authenticated_shopify_domain exposes the trusted authenticated shop.
• requested_shopify_domain exposes the sanitized requested shop parameter for bootstrap or routing use cases only.
• Token-exchange requests are rejected with 401 Unauthorized when the requested shop does not match the authenticated shop.

Impact

In affected applications, an attacker with a valid Shopify session token for one shop could send an authenticated request that also supplied a different shop query parameter. If the application relied on current_shopify_domain or params[:shop] for security-sensitive shop scoping, application code could operate in the context of the requested shop rather than the authenticated shop.

Affected applications are those that:

1. Use shopify_app token-exchange authentication;
2. Accept authenticated controller requests where a shop query parameter may be present; and
3. Use current_shopify_domain or the request shop parameter for authorization, tenant lookup, stored access-token selection, or shop-scoped resource access.

Depending on the application’s authorization model, this could result in unauthorized access to another shop’s application data or unauthorized shop-scoped actions.

Remediation

Upgrade to shopify_app version 23.0.3

Workarounds

Applications that cannot upgrade immediately should apply equivalent validation in token-exchange authenticated controllers:

• Do not use params[:shop] for authorization, tenant lookup, access-token selection, or data scoping.
• On vulnerable versions, avoid relying on current_shopify_domain for security-sensitive shop scoping if a shop query parameter may be present.
• Use the authenticated shop from the verified ID token or active Shopify session instead, such as current_shopify_session.shop or the verified JWT dest value.
  • If a sanitized params[:shop] value is present, reject the request with 401 Unauthorized when it does not match the authenticated shop.

Credit

This issue was responsibly reported by Hackerone researcher leqtuer.