Reflected XSS

How it was found

Hi team , I found a reflected xss on https://app.oberlo.com domain .

Reproduce :

• Visit https://app.oberlo.com/auth?shop=%3C/noscript%3E%3Cimg%20src=x%20onerror=prompt(document.domain)%3E in latest version of firefox browser .
• You will see popup like attacked screenshot : {F485407}

Tested in Latest version of firefox

Impact

As this is a auth so this xss can lead to some serious issues like stealing users auth token or stealing browser data/cookies .

Best Regards Prial