Cpe:2.3:a:shopify:shopify_app:*:*:*:*:*:ruby:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3ashopifyshopify_appruby/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 18:37:37 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgShopify App: Cross-shop authorization bypass (CVE-2026-63414)https://feed.craftedsignal.io/briefs/2026-10-shopify-app-auth-bypass/Thu, 29 Oct 2026 18:37:37 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-shopify-app-auth-bypass/The shopify_app Ruby gem contains a cross-shop authorization bypass vulnerability where user-supplied shop parameters can override cryptographically verified session contexts.The shopify_app gem (versions 22.1.0 through 23.0.2) is vulnerable to a context confusion flaw in token-exchange authenticated controllers. The helper current_shopify_domain inconsistently resolves to a sanitized shop query parameter rather than the shop identity derived from a verified Shopify ID token or active session. This allows an authenticated user to perform actions or access data belonging to a different shop by manipulating the shop request parameter.

Impact

Applications relying on current_shopify_domain or params[:shop] for authorization, tenant lookup, or access-token selection may suffer from unauthorized access to cross-shop application data or execution of shop-scoped actions. This impact is contingent on the application's internal authorization model and whether it consumes these specific, vulnerable helper methods.

Recommendation

  • Upgrade the shopify_app gem to version 23.0.3 or later immediately.
  • If immediate patching is not possible, modify controllers to avoid using params[:shop] for security-sensitive logic.
  • In legacy versions, implement a validation check in token-exchange controllers to ensure the shop parameter matches the domain verified in the session or JWT (e.g., current_shopify_session.shop), returning a 401 Unauthorized response on any mismatch.
]]>highadvisoryweb-applicationauthentication-bypassrubygemscve-2026-63414