{"action":"Upgrade shopify_app to 23.0.3 or later.","affected":[{"fixed":"23.0.3","introduced":"22.1.0"}],"component":"shopify_app","cve_ids":["CVE-2026-63414"],"ecosystem":"RubyGems","epss":0.00549,"exploited":false,"fixed_versions":["23.0.3"],"ghsa_id":"GHSA-6j52-38f8-qhxr","id":"tcs_01M6495VFYF6CP8M7DSZNN0CQA","modified_at":"2026-10-29T16:45:05.328073736Z","published_at":"2026-10-29T16:39:49Z","references":["https://osv.dev/vulnerability/GHSA-6j52-38f8-qhxr","https://github.com/Shopify/shopify_app/security/advisories/GHSA-6j52-38f8-qhxr","https://github.com/Shopify/shopify_app","https://github.com/Shopify/shopify_app/releases/tag/v23.0.3"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-6j52-38f8-qhxr","url":"https://osv.dev/vulnerability/GHSA-6j52-38f8-qhxr"}],"summary":"Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps"}