Shopify App: Cross-shop authorization bypass (CVE-2026-63414)

The shopify_app gem (versions 22.1.0 through 23.0.2) is vulnerable to a context confusion flaw in token-exchange authenticated controllers. The helper current_shopify_domain inconsistently resolves to a sanitized shop query parameter rather than the shop identity derived from a verified Shopify ID token or active session. This allows an authenticated user to perform actions or access data belonging to a different shop by manipulating the shop request parameter.

Impact

Applications relying on current_shopify_domain or params[:shop] for authorization, tenant lookup, or access-token selection may suffer from unauthorized access to cross-shop application data or execution of shop-scoped actions. This impact is contingent on the application's internal authorization model and whether it consumes these specific, vulnerable helper methods.

Recommendation

• Upgrade the shopify_app gem to version 23.0.3 or later immediately.
• If immediate patching is not possible, modify controllers to avoid using params[:shop] for security-sensitive logic.
• In legacy versions, implement a validation check in token-exchange controllers to ensure the shop parameter matches the domain verified in the session or JWT (e.g., current_shopify_session.shop), returning a 401 Unauthorized response on any mismatch.