Executive brief
Chatwoot is an open-source customer support platform that integrates with Shopify for authentication. An authenticated agent-level user can manipulate the Shopify OAuth callback endpoint to redirect credential exchange requests to an attacker-controlled server, leading to theft of Shopify API credentials and potential unauthorized access to Shopify applications.
Technical details
The vulnerability exists in the callbacks_controller.rb file where the Shopify OAuth callback endpoint constructs an OAuth2::Client using unsanitized user input (params[:shop]) as the site hostname without validation. When the OAuth2 gem exchanges an authorization code, it performs a POST request containing client_id and client_secret to an attacker-controlled host instead of the legitimate Shopify endpoint. An authenticated agent-level user can obtain a non-expiring state JWT (lacking expiration time and shop binding) and replay it with an arbitrary shop parameter, triggering the SSRF condition. The attack requires prior authentication to the Chatwoot instance and knowledge of valid Shopify app credentials configured in the system.
Affected products
- Chatwoot Chatwoot up to 4.17.1
Timeline
- 2026-09-16: disclosed
- other: Security issue reported 2026-05-11 with no vendor response