# Shopify admin authentication bypass using partners.shopify.com

Creating two partner accounts with the same business email let a partner auto-approve their own pending collaborator request and gain full access to any Shopify store.

- Payout: $20,000
- Severity: critical
- Program: Shopify
- Found by: rockrzhackr9z
- Disclosed: 2017-09-28
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/270981
- Library page: https://bugbountylibrary.com/r/h1%3A270981
- Tags: area:web domain:web impact:ato impact:privesc kind:bounty platform:hackerone sev:critical technique:chained vuln:access-control vuln:auth-bypass vuln:business-logic

**Target:** partners.shopify.com collaborator account conversion logic
**Root cause:** Auto-conversion code that turns an existing user account into a collaborator account did not verify the existing account's type, so a pending collaborator account was converted to active.
**Steps:**
1. Create two partner accounts sharing the same business email.
2. Request collaborator access to a target store, leaving the collaborator account in pending state.
3. Trigger the auto-conversion path so the pending collaborator account is converted into an active collaborator account.
4. Log in to the target store with full permissions without merchant interaction.
**How found:** Researcher experimented with partner account creation and noticed duplicate business emails could influence the collaborator auto-accept flow.
**Exploitation:** Attacker registers duplicate partner accounts on the same business email, requests collaborator access to a victim store, and the flawed auto-conversion logic activates the pending collaborator account, granting full store access.
**Insight:** When a feature auto-converts or auto-accepts accounts, test whether duplicate identities (same email) can make a pending privileged account satisfy the 'existing account' check.