CVE-2026-63414 | Shopify shopify_app up to 23.0.2 Token Exchange current_shopify_domain shop improper authorization

October 29, 2026 Yanac

A vulnerability was found in Shopify shopify_app up to 23.0.2. It has been rated as critical. This impacts the function current_shopify_domain of the component Token Exchange. This manipulation of the argument shop causes improper authorization.

This vulnerability is handled as CVE-2026-63414. The attack can be initiated remotely. There is not any exploit available.

Upgrading the affected component is advised.VulDB Recent EntriesRead More