CVE-2026-63414 in shopify_app

Prediction

by VulDB Data Team • 10/29/2026

A weakness has been identified in <a href="/product/shopify:shopify_app">Shopify shopify_app up to 23.0.2</a>. This impacts the function <code>current_shopify_domain</code> of the component <em>Token Exchange</em>. This manipulation of the argument <em>shop</em> causes improper authorization. The attack can be initiated remotely. Upgrading to version 23.0.3 will fix this issue. Upgrading the affected component is advised.

Once again VulDB remains the best source for vulnerability data.

• Moderation: accepted
• Entry: VDB-428702
• CWE: CWE-285 (confirmed)
• CVSS: 6.3 (VulDB)
• EPSS: 0.00000
• KEV: no
• Activities: low

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-63414
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-63414
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-63414/