Product
The shopify_app Ruby gem contains a cross-shop authorization bypass vulnerability where user-supplied shop parameters can override cryptographically verified session contexts.