Skip to content
BackEsc
Sign in

Shopify · disclosed reports

Authentication

61 disclosed reports · $36,200 paid

Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.

Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.

Open Shopify on HackerOne
reports
61
paid a bounty
31

Every one of the 61 is a mark on the map. Named now: 1 to 26, most upvoted first.

  1. H1514 [*.(my)shopify.com] - Viewing Password Protected Content#421859Shopify · $3,000 · 192 votes
  2. H1514 Session Fixation on multiple shopify-built apps on *.shopifycloud.com and *.shopifyapps.com#423136Shopify · 144 votes
  3. Bypass a fix for report #708013#1363672Shopify · $3,500 · 102 votes
  4. Bypass of biometrics security functionality is possible in Android application (com.shopify.mobile)#637194Shopify · $500 · 90 votes
  5. No Session Expiry after log-out, attacker can reuse the old cookies#1162443Shopify · $500 · 87 votes
  6. Stealing livechat token and using it to chat as the user - user information disclosure#151058Shopify · 71 votes
  7. Subdomain Takeover Via unclaimed Heroku Instance tim-exclusive.shopify.com#424669Shopify · $500 · 68 votes
  8. Session Persistence Designed to Keep Users Logged In Across Multiple Devices (Intended Behaviour)#3161827Shopify · 63 votes
  9. Insufficient session expiration in the **com.shopify.ping** android app#1172205Shopify · 63 votes
  10. Unauthenticated access to Zendesk tickets through athena-flex-production.shopifycloud.com Okta bypass#397130Shopify · 61 votes
  11. Authentication Bypass on Icinga monitoring server#143482Shopify · 42 votes
  12. Exposed Slinky Instance Admin Panel#808762Shopify · 41 votes
  13. StoreFront API allows for a brute force attack on customer login by not timing out ALL attempts#708013Shopify · 38 votes
  14. Unauthenticated access to Checkout Blocks employee-only endpoints exposed merchant metadata#3954327Shopify · $3,100 · 33 votes
  15. Account takeover intercepting magic link for Arrive app#855618Shopify · 33 votes
  16. Shop App - Attacker is able to intercept authorization code during authentication (OAuth) and is able to get access to Microsoft Outlook email account#1700734Shopify · $900 · 31 votes
  17. Ability to connect an external login service for unverified emails/accounts at accounts.shopify.com#1018489Shopify · $1,600 · 29 votes
  18. IDOR expire other user sessions#56511Shopify · $1,000 · 29 votes
  19. Direct Access To admin Dashboard#1421804Shopify · 26 votes
  20. user with no draft order permission can still perform action on draft order's in stocky app (idor)#802286Shopify · 26 votes
  21. Disconnecting an external login provider does not revoke session#1547684Shopify · $1,600 · 21 votes
  22. Store Deletion or Sell without authentication#1087382Shopify · 20 votes
  23. Unauthorized access to Zookeeper on http://locutus-zk3.ec2.shopify.com:2181#154369Shopify · $1,000 · 20 votes
  24. Read access to hidden orders,products,customers etc. by limited access Staff member through reference page in Comments (Information disclosure )#154405Shopify · 19 votes
  25. Add signature to transactions without any permission#172733Shopify · $500 · 15 votes
  26. your-store.myshopify.com preview link is leak on third party website lead to preview all action from store owner Without store Password.#997350Shopify · $500 · 14 votes

paid a bounty

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in