# password less login token expiration issue

Shopify iOS app's passwordless login token stayed valid after the user revoked the app's access, letting a revoked app still log in as the user.

- Payout: $500
- Severity: medium
- Program: Shopify
- Credited: satishb3
- Disclosed: 2016-10-19
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/172837
- Library page: https://bugbountylibrary.com/r/h1%3A172837
- Tags: domain:mobile domain:web impact:ato impact:internal-access kind:bounty platform:hackerone sev:medium tech:graphql tech:oauth vuln:access-control vuln:auth-bypass

**Target:** Shopify Admin GraphQL adminPasswordlessLogin mutation / login_token
**Root cause:** Revoking an app's access token did not invalidate previously issued passwordless login tokens, so a token minted before revocation remained usable.
**Steps:**
1. Authenticate as Alice via Shopify iOS app and capture `X-Shopify-Access-Token`.
2. `POST /admin/api/graphql` with `mutation{adminPasswordlessLogin(input:{}){passwordlessLoginToken}}` to mint a login token; do not consume it.
3. From desktop, log in as Alice and revoke the iOS app's access.
4. Visit `https://<shop>.myshopify.com/admin?login_token=<token>` — still logs in as Alice.
**How found:** Researcher noticed the passwordless login token is a separate credential from the access token and tested whether revocation invalidated it; it did not.
**Exploitation:** A malicious app mints an unused passwordless login token, waits for the user to revoke its access, then redeems the token via the admin login_token URL to regain full session access to the user's store.
**Insight:** When a platform has multiple credential types (access tokens, login tokens, session tokens), test whether revoking one credential type invalidates the others — revocation often only touches the token the app presented.