HexBrain

Shopify · Report #194832

Authentication Bypass on monitoring server

Validstatus
lowseverity
12upvotes
11 Jan 2017disclosed

How it was found

Hello,

This issue has the same impact as this one: #143482. But the fix is not complete, there is a shopify subdomain (VPN server) where you still can connect your google account. This should be hide and protected.

So you guys need to change this so that only shopify.com Google accounts are accepted.

POC screen: ███████

Let me know about it and happy new year!!

Jamesclyde90

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original