AIKIDO-2026-629620

TL;DR

The social-auth-core LINE and Shopify OAuth backends complete the login callback without validating the OAuth state parameter against the value stored in the session. The Shopify backend also never sends a state parameter when building its authorization URL, so the callback cannot be tied to the session that started the flow. An attacker can craft a callback request and trick a victim into completing it, logging the victim into an account chosen by the attacker. The fix sends a state value on the Shopify authorization request and validates the callback state in both backends before exchanging the authorization code.