CVE-2020-8176: Shopify Koa-Shopify-Auth

Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days.

A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the `shop` parameter on the `/shopify/auth/enable_cookies` endpoint.

Affected products

• Shopify Koa-Shopify-Auth: version 3.1.61 only; version 3.1.62 only

Published 2020-07-02. Last modified 2026-06-17.