Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
💎 RubyGems
Not in CISA KEV

CVE-2026-63414 — shopify_app

CVE-2026-63414 is a security vulnerability in shopify_app. A fix is available for shopify_app — see the affected versions and patch details below.

Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps

Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Oct 29, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected
💎shopify_app

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects RubyGems packages — download data is not available via public APIs for these ecosystems.

Description

In token-exchange authenticated controllers, shopify_app exposes shop context through helpers such as current_shopify_domain. Prior to the fix, current_shopify_domain could resolve to the sanitized shop query parameter instead of the shop identity derived from the verified Shopify ID token or active Shopify session.

As a result, a request authenticated for one shop could include a different shop query parameter, causing application code to treat the requested shop as the current shop.

Applications that used current_shopify_domain, or the request shop parameter, for authorization decisions, tenant lookup, stored access-token selection, or shop-scoped data access may have been vulnerable to cross-shop context confusion.

The patched version hardens token-exchange handling so that:

  • current_shopify_domain resolves to the authenticated shop from the verified token or session.
  • authenticated_shopify_domain exposes the trusted authenticated shop.
  • requested_shopify_domain exposes the sanitized requested shop parameter for bootstrap or routing use cases only.
  • Token-exchange requests are rejected with 401 Unauthorized when the requested shop does not match the authenticated shop.

Impact

In affected applications, an attacker with a valid Shopify session token for one shop could send an authenticated request that also supplied a different shop query parameter. If the application relied on current_shopify_domain or params[:shop] for security-sensitive shop scoping, application code could operate in the context of the requested shop rather than the authenticated shop.

Affected applications are those that:

  1. Use shopify_app token-exchange authentication;
  2. Accept authenticated controller requests where a shop query parameter may be present; and
  3. Use current_shopify_domain or the request shop parameter for authorization, tenant lookup, stored access-token selection, or shop-scoped resource access.

Depending on the application’s authorization model, this could result in unauthorized access to another shop’s application data or unauthorized shop-scoped actions.

Remediation

Upgrade to shopify_app version 23.0.3

Workarounds

Applications that cannot upgrade immediately should apply equivalent validation in token-exchange authenticated controllers:

  • Do not use params[:shop] for authorization, tenant lookup, access-token selection, or data scoping.
  • On vulnerable versions, avoid relying on current_shopify_domain for security-sensitive shop scoping if a shop query parameter may be present.
  • Use the authenticated shop from the verified ID token or active Shopify session instead, such as current_shopify_session.shop or the verified JWT dest value.
    • If a sanitized params[:shop] value is present, reject the request with 401 Unauthorized when it does not match the authenticated shop.

Credit

This issue was responsibly reported by Hackerone researcher leqtuer.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
💎RubyGemsshopify_app≥ 22.1.0&&< 23.0.323.0.3bundle update shopify_app --conservative

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for shopify_app, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update shopify_app to 23.0.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-63414 is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

In token-exchange authenticated controllers, `shopify_app` exposes shop context through helpers such as `current_shopify_domain`. Prior to the fix, `current_shopify_domain` could resolve to the sanitized `shop` query parameter instead of the shop identity derived from the verified Shopify ID token or active Shopify session. As a result, a request authenticated for one shop could include a different `shop` query parameter, causing application code to treat the requested shop as the current shop. Applications that used `current_shopify_domain`, or the request `shop` parameter, for authorizatio
O3 Security · Impact-Aware SCA

Is CVE-2026-63414 in your dependencies?

Find it across RubyGems, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2026-63414: shopify_app — Fixed in 23.0.3