RubyGems/shopify_app CVE-2026-63414: high, EPSS 0.55%
Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps
Action: Upgrade shopify_app to 23.0.3 or later.
bundle update shopify_appAffected
| introduced | fixed | last affected |
|---|---|---|
| 22.1.0 | 23.0.3 | - |
Fixed versions
| 23.0.3 |
Sources
- osv: GHSA-6j52-38f8-qhxr
- https://github.com/Shopify/shopify_app/security/advisories/GHSA-6j52-38f8-qhxr
- https://github.com/Shopify/shopify_app
- https://github.com/Shopify/shopify_app/releases/tag/v23.0.3
CVE-2026-63414 · published · modified · JSON