Shopify · disclosed reports
Input Validation and Logic
11 disclosed reports · $1,400 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Shopify on HackerOne- reports
- 11
- paid a bounty
- 2
Every one of the 11 is a mark on the map. Named now: 1 to 11, most upvoted first.
- H1514 Ability to MiTM Shopify PoS Session to Takeover Communications
- Exposure of shopify employee summit page allows anonymous user to place orders for free books
- myshopify.com domain takeover
- Ability to Disable the Login Attempt of any Shopify Owner for 24 hrs (Zero_Click)
- Unauthenticated read and write access to ALL endpoints of a store is possible for removed staff members who had "Apps" permission
- Potential to abuse pricing errors in saved carts
- Race condition at create new Location
- H1514 Simple phishing using auto-created modal with weak URL-pattern check in incontext_app_link
- Bypass GraphQL rate limit by abusing negative cost queries
- [h1-2102] [Yaworski's Broskis] Suspected overcharge and chargebacks in PoS
- H1514 Shopify API ruby SDK session setup lacks input validation, resulting in SSRF and leakage of client secret
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.