{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3ashopifyshopify_appruby/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:shopify:shopify_app:*:*:*:*:*:ruby:*:*"],"_cs_cves":[{"id":"CVE-2026-63414"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["shopify_app (\u003e= 22.1.0, \u003c 23.0.3)"],"_cs_severities":["high"],"_cs_tags":["web-application","authentication-bypass","rubygems","cve-2026-63414"],"_cs_type":"advisory","_cs_vendors":["Shopify"],"content_html":"\u003cp\u003eThe \u003ccode\u003eshopify_app\u003c/code\u003e gem (versions 22.1.0 through 23.0.2) is vulnerable to a context confusion flaw in token-exchange authenticated controllers. The helper \u003ccode\u003ecurrent_shopify_domain\u003c/code\u003e inconsistently resolves to a sanitized \u003ccode\u003eshop\u003c/code\u003e query parameter rather than the shop identity derived from a verified Shopify ID token or active session. This allows an authenticated user to perform actions or access data belonging to a different shop by manipulating the \u003ccode\u003eshop\u003c/code\u003e request parameter.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eApplications relying on \u003ccode\u003ecurrent_shopify_domain\u003c/code\u003e or \u003ccode\u003eparams[:shop]\u003c/code\u003e for authorization, tenant lookup, or access-token selection may suffer from unauthorized access to cross-shop application data or execution of shop-scoped actions. This impact is contingent on the application's internal authorization model and whether it consumes these specific, vulnerable helper methods.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the \u003ccode\u003eshopify_app\u003c/code\u003e gem to version 23.0.3 or later immediately.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, modify controllers to avoid using \u003ccode\u003eparams[:shop]\u003c/code\u003e for security-sensitive logic.\u003c/li\u003e\n\u003cli\u003eIn legacy versions, implement a validation check in token-exchange controllers to ensure the \u003ccode\u003eshop\u003c/code\u003e parameter matches the domain verified in the session or JWT (e.g., \u003ccode\u003ecurrent_shopify_session.shop\u003c/code\u003e), returning a \u003ccode\u003e401 Unauthorized\u003c/code\u003e response on any mismatch.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T18:37:37Z","date_published":"2026-10-29T18:37:37Z","id":"https://feed.craftedsignal.io/briefs/2026-10-shopify-app-auth-bypass/","summary":"The shopify_app Ruby gem contains a cross-shop authorization bypass vulnerability where user-supplied shop parameters can override cryptographically verified session contexts.","title":"Shopify App: Cross-shop authorization bypass (CVE-2026-63414)","url":"https://feed.craftedsignal.io/briefs/2026-10-shopify-app-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:shopify:shopify_app:*:*:*:*:*:ruby:*:*","version":"https://jsonfeed.org/version/1.1"}