Answer in brief
CVE-2026-63414 records a High severity vulnerability in Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps. The current sources do not mark it as known exploited. The current feed maps shopify_app (rubygems), shopify_app (rubygems). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps shopify_app (rubygems), shopify_app (rubygems). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| shopify_apprubygems | >=22.1.0,<23.0.3 | 23.0.3 |
| shopify_apprubygems | >=22.1.0 <23.0.3 | 23.0.3 |
Published upstream
Oct 29, 2026
Evidence: source:ghsa:source_dates:source-dates:recordSource modified
Oct 29, 2026
Evidence: source:ghsa:source_dates:source-dates:recordFirst seen by HOL
Oct 29, 2026
In token-exchange authenticated controllers, `shopify_app` exposes shop context through helpers such as `current_shopify_domain`. Prior to the fix, `current_shopify_domain` could resolve to the sanitized `shop` query parameter instead of the shop identity derived from the verified Shopify ID token or active Shopify session. As a result, a request authenticated for one shop could include a different `shop` query parameter, causing application code to treat the requested shop as the current shop. Applications that used `current_shopify_domain`, or the request `shop` parameter, for authorization decisions, tenant lookup, stored access-token selection, or shop-scoped data access may have been vulnerable to cross-shop context confusion. The patched version hardens token-exchange handling so that: - `current_shopify_domain` resolves to the authenticated shop from the verified token or session. - `authenticated_shopify_domain` exposes the trusted authenticated shop. - `requested_shopify_domain` exposes the sanitized requested `shop` parameter for bootstrap or routing use cases only. - Token-exchange requests are rejected with `401 Unauthorized` when the requested shop does not match the authenticated shop. ## Impact In affected applications, an attacker with a valid Shopify session token for one shop could send an authenticated request that also supplied a different `shop` query parameter. If the application relied on `current_shopify_domain` or `params[:shop]` for security-sensitive shop scoping, application code could operate in the context of the requested shop rather than the authenticated shop. Affected applications are those that: 1. Use `shopify_app` token-exchange authentication; 2. Accept authenticated controller requests where a `shop` query parameter may be present; and 3. Use `current_shopify_domain` or the request `shop` parameter for authorization, tenant lookup, stored access-token selection, or shop-scoped resource access. Depending on the application’s authorization model, this could result in unauthorized access to another shop’s application data or unauthorized shop-scoped actions. ## Remediation Upgrade to `shopify_app` version `23.0.3` ## Workarounds Applications that cannot upgrade immediately should apply equivalent validation in token-exchange authenticated controllers: - Do not use `params[:shop]` for authorization, tenant lookup, access-token selection, or data scoping. - On vulnerable versions, avoid relying on `current_shopify_domain` for security-sensitive shop scoping if a `shop` query parameter may be present. - Use the authenticated shop from the verified ID token or active Shopify session instead, such as `current_shopify_session.shop` or the verified JWT `dest` value. - If a sanitized `params[:shop]` value is present, reject the request with `401 Unauthorized` when it does not match the authenticated shop. ## Credit This issue was responsibly reported by Hackerone researcher [leqtuer](https://hackerone.com/leqtuer?type=user).
Quoted source text, attributed separately from HOL analysis.