Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps
In token-exchange authenticated controllers, shopify_app exposes shop context through helpers such as current_shopify_domain. Prior to the fix, current_shopify_domain could resolve to the sanitized shop query parameter instead of the shop identity derived from the verified Shopify ID token or active Shopify session. As a result, a request authenticated for one shop could include a different shop query parameter, causing application code to treat the requested shop as the current shop. …