Shopify · disclosed reports
Misconfiguration and Insecure Design
18 disclosed reports · $7,600 paid · 17 valid · 1 informative
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open Shopify on HackerOne- reports
- 18
- valid
- 17
- paid a bounty
- 3
Every one of the 18 is a mark on the map. Named now: 1 to 18, most upvoted first.
- Exposed Cortex API at https://cortex-ingest.shopifycloud.com/
- Ability to verify any email address you don't own - accounts.shopify.com
- XSS Stored via Upload avatar PNG [HTML] File in accounts.shopify.com
- Shopify.com Web Cache Deception vulnerability leads to personal information and CSRF tokens leakage
- App messaging can be hijacked by third-party websites
- Clickjacking in [exchangemarketplace.com]
- race condition in adding team members
- Password reset token leak via "Host header" on third party website
- SSRF via 'Add Image from URL' feature
- Subdomain Takeover of multiple *.ttcdn.co domains
- SSL cookie without secure flag set
- Content Spoofing
- SSRF via 'Insert Image' feature of Products/Collections/Frontpage
- Header Misconfiguration - PHP API
- CSRF token fixation in facebook store app that can lead to adding attacker to victim acc
- Passwords Returned in Later Responses.
- Multiple issues on Checkout Process
- Cookie securing your "Opening soon" store is not secured against XSS
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.