ZDF
Sign inSign up

Vulnerabilities

Security fix · CVE-2026-63414

Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps

Published Oct 29, 2026 · catalog updated Oct 29, 2026 · Shopify App: Token exchange

Last checked Nov 5, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-63414. EPSS is 0.75%. Act only if a listed version of Shopify App: Token exchange is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Shopify App: Token exchange).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High—
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.75%
Remediation
Version ranges on file
Affected products
RubyGems shopify_app · gem shopify_app · rubygems shopify_app

In token-exchange authenticated controllers, exposes shop context through helpers such as . Prior to the fix, could resolve to the sanitized query parameter instead of the shop identity derived from the verified Shopify ID token or active Shopify session. As a result, a request authenticated for one shop could include a different query parameter, causing application code to treat the requested shop as the current shop. Applications that used , or the request parameter, for authorization decisions, tenant lookup, stored access-token selection, or shop-scoped data access may have been vulnerable to cross-shop context confusion. The patched version hardens token-exchange handling so that: - resolves to the authenticated shop from the verified token or session. - exposes the trusted authenticated shop. - exposes the sanitized requested parameter for bootstrap or routing use cases only. - Token-exchange requests are rejected with when the requested shop does not match the authenticated shop. ## Impact In affected applications, an attacker with a valid Shopify session token for one shop could send an authenticated request that also supplied a different query parameter. If the application relied on or for security-sensitive shop scoping, application code could operate in the context of the requested shop rather than the authenticated shop. Affected applications are those that: 1. Use token-exchange authentication; 2. Accept authenticated controller requests where a query parameter may be present; and 3. Use or the request parameter for authorization, tenant lookup, stored access-token selection, or shop-scoped resource access. Depending on the application’s authorization model, this could result in unauthorized access to another shop’s application data or unauthorized shop-scoped actions. ## Remediation Upgrade to version ## Workarounds Applications that cannot upgrade immediately should apply equivalent validation in token-exchange authenticated controllers: - Do not use

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • RubyGems shopify_app22.1.0 → 23.0.3
  • gem shopify_app>=22.1.0 <23.0.3
  • rubygems shopify_app>= 22.1.0, < 23.0.3

How to fix CVE-2026-63414

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-63414. EPSS is 0.75%. Act only if a listed version of Shopify App: Token exchange is installed.

Which versions are affected?

Compare what you have installed with 22.1.0 → 23.0.3, >=22.1.0 <23.0.3, >= 22.1.0, < 23.0.3. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-863: Incorrect Authorization. EPSS 0.75%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 29, 2026 · GitHub Advisory Database

    Detected

    In token-exchange authenticated controllers, exposes shop context through helpers such as . Prior to the fix, could resolve to the sanitized query parameter instead of the shop identity derived from the verified Shopify ID token or active Shopify session. As a result, a request authenticated for one shop could include a different query parameter, causing application code to treat the requested sho

  2. Oct 29, 2026 · GitHub Advisory Database

    Fix available

    shopify_app fixed in 23.0.3

  3. Oct 29, 2026 · GitHub Advisory Database

    Fix available

    shopify_app fixed in 23.0.3

  4. Oct 29, 2026 · GitHub Advisory Database

    Updated

    In token-exchange authenticated controllers, exposes shop context through helpers such as . Prior to the fix, could resolve to the sanitized query parameter instead of the shop identity derived from the verified Shopify ID token or active Shopify session. As a result, a request authenticated for one shop could include a different query parameter, causing application code to treat the requested sho

Sources

  • CVE.orgVulnerability recordCVE-2026-63414

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-63414

    30-day exploitation probability 0.75%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-6j52-38f8-qhxr

    GitHub Advisory Database record mirrored by OSV.

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-63414

    In token-exchange authenticated controllers, shopify_app exposes shop context through helpers such as current_shopify_domain. Prior to the fix, current_shopify_domain could resolve to the sanitized shop query parameter instead of the shop identity derived from the verified Shopify ID token or active Shopify session. As a result, a request authenticated for one shop could include a different shop q

    advisories.gitlab.com
  • GitLab Advisory DatabasePackage advisorygem/shopify_app/CVE-2026-63414.yml

    In token-exchange authenticated controllers, exposes shop + context through helpers such as . Prior to the fix, + could resolve to the sanitized query parameter instead of the shop identity + derived from the verified Shopify ID token or active Shopify session.\n\nAs a result, + a request authenticated for one shop could include a different query parameter, + causing application code to treat the

    gitlab.com
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-6j52-38f8-qhxr

    Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps

    osv.dev

References

Freshness

Last verified in this catalog Nov 5, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • FIRST EPSSNov 5, 2026
  • GitLab Advisory DatabaseNov 3, 2026
  • GitHub Advisory DatabaseNov 2, 2026
  • OpenSSF OSV / OSV ScannerNov 2, 2026
  • CVE.orgOct 30, 2026
  • GitLab Advisory DatabaseOct 30, 2026