Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, "token-exchange" authenticated controllers can expose a request-derived "shop" context instead of the identity from a verified Shopify ID token or active Shopify session. "current_shopify_domain" can resolve to the sanitized "shop" query parameter, so a request authenticated for one "shop" can cause application code to treat a different requested "shop" as current. Affected applications use "shopify_app" "token-exchange" authentication, accept authenticated requests with a "shop" query parameter, and rely on "current_shopify_domain" or "params[:shop]" for authorization, tenant lookup, stored access-token selection or "shop"-scoped data access. An attacker with a valid Shopify session token for one "shop" can supply another "shop" in that parameter and potentially obtain unauthorized application data or perform "shop"-scoped actions, depending on the application's authorization model. This issue is fixed in version 23.0.3.