Setting Arbitrary Cookie at kitcrm.com #213991 Valid No weakness recorded None 2017-08-23 – 2 Lack of SSL Pinning on POS Application ( iOS ) #55644 Informative Cryptography None 2015-05-21 – 3 Multiple issues on Checkout Process #56800 Informative Misconfiguration and Insecure Design None 2015-05-21 – 3 The POS Firmware is leaking the root Password which can be used for unauthorized access to the device. #92633 Informative No weakness recorded None 2015-10-09 – 3 XSS - URL Redirects #56662 Informative Cross-site Scripting None 2015-05-16 – 4 Same the Url #1459338 Valid No weakness recorded None 2022-04-21 $500 8 H1514 Shopify API ruby SDK session setup lacks input validation, resulting in SSRF and leakage of client secret #423437 Valid Input Validation and Logic None 2019-04-05 – 11 Screenshot Service leaks X-ABS-App-Token #1067443 Valid Server-Side Request Forgery None 2021-02-12 – 14 Subdomain Takeover at course.oberlo.com #1690951 Valid Access Control None 2022-12-01 – 14 Disclose STUFF member name and make actions. #968174 Valid Information Disclosure None 2022-05-14 $500 15 Improper Input Validation on https://oberlo-image-proxy.shopifycloud.com/ #1267677 Valid No weakness recorded None 2021-08-16 – 16 [https://shipit-sox-staging.shopifycloud.com] Presence of multiple vulnerabilities present in Ruby On Rails #1400309 Valid Cross-Site Request Forgery None 2022-04-16 – 17 Publicly Accessible Datadog link Analysed #345152 Valid Information Disclosure None 2018-06-15 – 18 Missing HMAC validation on /uninstall webhook in Shopify/sample-django-app reference template #3697491 Informative Cryptography None 2026-06-01 – 18 Domain Takeover at 3hopify.media Analysed #1344982 Valid Access Control None 2021-10-21 – 19 Ability to potentially hit internal NGINX locations on *.myshopify.com by making use of the `X-Accel-Redirect` header via a configured App Proxy Analysed #1027873 Valid No weakness recorded None 2021-02-11 – 22 Apache Flink Dashboard exposure at https://streaming-sales-model-production.flink.shopifykloud.com Analysed #1262907 Valid Information Disclosure None 2021-11-18 – 23 Is the Google Bucket Meant To Be Publicly Listable? https://cdn.shopify.com/shop-assets/ Analysed #1102546 Valid No weakness recorded None 2022-02-09 – 25 Direct Access To admin Dashboard Analysed #1421804 Valid Authentication None 2022-01-20 – 26 GraphQL Introspection Enabled on Shopify API Endpoint (Intended Behavior) #2886723 Informative Information Disclosure None 2025-09-17 – 28 Senseitive data Related to Shopify Host -> https://shopify.zendesk.com/ Analysed #1298809 Valid Cryptography None 2021-11-08 – 29 XSS on "widgets.shopifyapps.com" via "stripping" attribute and "shop" parameter Analysed #246794 Valid Cross-site Scripting None 2018-04-03 $1,000 32 Production Key and Data Found on Subdomain No Longer Operated by Shopify / Dangling DNS Analysed #1590115 Valid Information Disclosure None 2024-05-01 – 34 mruby-engine: UAF in MRubyEngine#initialize enables local RCE #3679660 Informative No weakness recorded None 2026-04-24 – 35 Exposed Slinky Instance Admin Panel Analysed #808762 Valid Authentication None 2021-01-16 – 41 H1514 [beerify.shopifycloud.com] GraphQL discloses internal beer consumption Analysed #419883 Valid Information Disclosure None 2019-05-08 $802 57 Session Persistence Designed to Keep Users Logged In Across Multiple Devices (Intended Behaviour) #3161827 Informative Authentication None 2025-09-04 – 63 Exposure of shopify employee summit page allows anonymous user to place orders for free books #2552027 Informative Input Validation and Logic None 2024-07-29 – 76 admin.shopify.com: Shopify Flow continues sending internal emails to a configured recipient after the staff author is removed #3628961 Informative No weakness recorded None 2026-07-03 – 78