Threats tagged 'ghsa-6j52-38f8-qhxr'

A vulnerability in the Shopify App's token-exchange authentication allowed cross-shop authorization bypass due to confusion between the authenticated shop context and the shop specified in the request parameter. This could lead to unauthorized access or actions in another shop's context if the application used the vulnerable helpers for security-sensitive decisions. The issue is fixed in shopify_app version 23.0.3.