# CVE-2026-63414: Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps

> CVE-2026-63414: Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps. CVSS 7.6 (CVSS 4.0).

Canonical: https://rewindex.com/cve/CVE-2026-63414
Last updated: 2026-11-02T19:14:53Z

- Published: 2026-10-30 22:49 UTC · Updated: 2026-11-02 19:14 UTC · Assigner: GitHub\_M
- CVSS: 7.6 (CVSS 4.0) · Severity: High
- EPSS: 0.55%, 46th percentile (scored 2026-11-04)
- CISA KEV: no
- CWE: CWE-863

## Description

Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, \`token-exchange\` authenticated controllers can expose a request-derived \`shop\` context instead of the identity from a verified Shopify ID token or active Shopify session. \`current\_shopify\_domain\` can resolve to the sanitized \`shop\` query parameter, so a request authenticated for one \`shop\` can cause application code to treat a different requested \`shop\` as current. Affected applications use \`shopify\_app\` \`token-exchange\` authentication, accept authenticated requests with a \`shop\` query parameter, and rely on \`current\_shopify\_domain\` or \`params\[:shop\]\` for authorization, tenant lookup, stored access-token selection or \`shop\`-scoped data access. An attacker with a valid Shopify session token for one \`shop\` can supply another \`shop\` in that parameter and potentially obtain unauthorized application data or perform \`shop\`-scoped actions, depending on the application's authorization model. This issue is fixed in version 23.0.3.

## Affected vendors and products

- Shopify: shopify\_app

## Tracked companies

- [Shopify](https://rewindex.com/company/shopify.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-63414)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-63414)
- [https://github.com/Shopify/shopify\_app/commit/a09ccc04b9556cbb31c6d56ed81aeb6b9b6c0756](https://github.com/Shopify/shopify_app/commit/a09ccc04b9556cbb31c6d56ed81aeb6b9b6c0756)
- [https://github.com/Shopify/shopify\_app/pull/2081](https://github.com/Shopify/shopify_app/pull/2081)
- [https://github.com/Shopify/shopify\_app/releases/tag/v23.0.3](https://github.com/Shopify/shopify_app/releases/tag/v23.0.3)
- [https://github.com/Shopify/shopify\_app/security/advisories/GHSA-6j52-38f8-qhxr](https://github.com/Shopify/shopify_app/security/advisories/GHSA-6j52-38f8-qhxr)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-63414 · Markdown: https://rewindex.com/cve/CVE-2026-63414.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-63414 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-11-04T16:33:24.401Z