AIKIDO-2026-492382

TL;DR

The app proxy authentication flow in @shopify/shopify-app-react-router verifies a Shopify-signed request by validating an HMAC over the forwarded query parameters. Before the fix, the validation flattened the query string in a way that mishandled repeated parameters, so duplicated security parameters such as signature, shop, or timestamp could desynchronize the value used for signature verification from the value the application later reads. This gap lets a tampered app proxy request pass HMAC validation while carrying externally influenced parameter values, undermining the request's authenticity. The fix consumes structured URL search parameters and rejects repeated security parameters while still preserving repeated application query parameters.