{"affected":[{"product":"shopify_app","source":"CNA: GitHub_M","vendor":"Shopify","versions":[{"status":"affected","version":">= 22.1.0, < 23.0.3"}]},{"ecosystem":"rubygems","packageName":"shopify_app","product":"shopify_app","source":"GitHub GHSA-6j52-38f8-qhxr","vendor":"","versions":[{"status":"affected","version":">= 22.1.0, < 23.0.3","versionType":"GitHub advisory range"}]},{"defaultStatus":"unaffected","ecosystem":"RubyGems","packageName":"shopify_app","product":"shopify_app","source":"OSV GHSA-6j52-38f8-qhxr","vendor":"","versions":[{"status":"affected","version":"22.1.0","versionType":"RubyGems"},{"status":"affected","version":"22.2.0","versionType":"RubyGems"},{"status":"affected","version":"22.2.1","versionType":"RubyGems"},{"status":"affected","version":"22.3.0","versionType":"RubyGems"},{"status":"affected","version":"22.3.1","versionType":"RubyGems"},{"status":"affected","version":"22.4.0","versionType":"RubyGems"},{"status":"affected","version":"22.5.0","versionType":"RubyGems"},{"status":"affected","version":"22.5.1","versionType":"RubyGems"},{"status":"affected","version":"22.5.2","versionType":"RubyGems"},{"status":"affected","version":"23.0.0","versionType":"RubyGems"},{"status":"affected","version":"23.0.1","versionType":"RubyGems"},{"status":"affected","version":"23.0.2","versionType":"RubyGems"},{"events":[{"introduced":"22.1.0"},{"fixed":"23.0.3"}],"status":"unknown","version":"22.1.0","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2026-63414","cwes":["CWE-863"],"description":"Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, `token-exchange` authenticated controllers can expose a request-derived `shop` context instead of the identity from a verified Shopify ID token or active Shopify session. `current_shopify_domain` can resolve to the sanitized `shop` query parameter, so a request authenticated for one `shop` can cause application code to treat a different requested `shop` as current. Affected applications use `shopify_app` `token-exchange` authentication, accept authenticated requests with a `shop` query parameter, and rely on `current_shopify_domain` or `params[:shop]` for authorization, tenant lookup, stored access-token selection or `shop`-scoped data access. An attacker with a valid Shopify session token for one `shop` can supply another `shop` in that parameter and potentially obtain unauthorized application data or perform `shop`-scoped actions, depending on the application's authorization model. This issue is fixed in version 23.0.3.","epss":{"date":"2026-11-04","percentile":0.46073,"score":0.00549},"exploits":[],"kev":null,"metrics":[{"score":7.6,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0"},{"score":7.6,"severity":"high","source":"NVD: security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0"}],"modifiedAt":1793847700702,"publishedAt":1793400587431,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/Shopify/shopify_app/security/advisories/GHSA-6j52-38f8-qhxr"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/Shopify/shopify_app/pull/2081"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/Shopify/shopify_app/commit/a09ccc04b9556cbb31c6d56ed81aeb6b9b6c0756"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/Shopify/shopify_app/releases/tag/v23.0.3"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/Shopify/shopify_app/commit/a09ccc04b9556cbb31c6d56ed81aeb6b9b6c0756"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/Shopify/shopify_app/pull/2081"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/Shopify/shopify_app/releases/tag/v23.0.3"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/Shopify/shopify_app/security/advisories/GHSA-6j52-38f8-qhxr"},{"source":"GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/Shopify/shopify_app/security/advisories/GHSA-6j52-38f8-qhxr"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-6j52-38f8-qhxr"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-6j52-38f8-qhxr"}],"remediation":[{"kind":"fix","source":"GitHub GHSA-6j52-38f8-qhxr","text":"shopify_app (rubygems): GitHub reports patched versions 23.0.3. Check the advisory for the affected release branch.","url":"https://github.com/Shopify/shopify_app/security/advisories/GHSA-6j52-38f8-qhxr"},{"kind":"fix","source":"OSV GHSA-6j52-38f8-qhxr","text":"shopify_app (RubyGems): OSV reports a fixed version 23.0.3. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-6j52-38f8-qhxr"}],"revision":"20519d24c1ad546945d5495333fb6b3ac2cd05901324478971bb2bbd4ba34bcb","sources":[{"modifiedAt":1793847700702,"name":"CNA: GitHub_M","retrievedAt":1793851729836,"url":"https://www.cve.org/CVERecord?id=CVE-2026-63414"},{"modifiedAt":1793646893030,"name":"NVD","retrievedAt":1793665732953,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63414"},{"modifiedAt":1784237635000,"name":"GitHub Security Advisories","retrievedAt":1793755209646,"url":"https://github.com/Shopify/shopify_app/security/advisories/GHSA-6j52-38f8-qhxr"},{"modifiedAt":1793292305328,"name":"OSV / GitHub Security Advisories","retrievedAt":1793665733589,"url":"https://osv.dev/vulnerability/GHSA-6j52-38f8-qhxr"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793851735190,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-63414"}],"ssvc":{"assessedAt":1793847690497,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps","updatedAt":1793851735190}