Skip to content
OpenAdvisories

Product · Shopify

shopify_app

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.6
    CVE-2026-63414

    Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps

    Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, `token-exchange` authenticated controllers can expose a request-derived `shop` context instead of the identity from a verified Shopify ID token or active Shopify sessio…

    Shopify shopify_app shopify_app RubyGems