# Unauthenticated access to Zendesk tickets through athena-flex-production.shopifycloud.com Okta bypass

Unauthenticated GraphQL endpoint on Shopify's athena-flex app leaked Zendesk ticket contents (subjects, descriptions, requester names) for any shop domain.

- Payout: $5,000
- Severity: critical
- Program: Shopify
- Found by: rijalrojan
- Disclosed: 2018-09-19
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/397130
- Library page: https://bugbountylibrary.com/r/h1%3A397130
- Tags: area:web domain:api domain:web impact:data-leak impact:pii-leak kind:bounty platform:hackerone sev:critical tech:graphql technique:js-analysis technique:source-review vuln:access-control vuln:auth-bypass vuln:info-disclosure

**Target:** athena-flex-production.shopifycloud.com /graphql
**Root cause:** The app returned 200 with its JS bundle before the Okta redirect, and the /graphql endpoint served ticket queries without enforcing authentication.
**Steps:**
1. Load `view-source:athena-flex-production.shopifycloud.com` to capture the pre-redirect HTML and script src.
2. Fetch and beautify `https://cdn.shopifycloud.com/athena-flex/assets/main-3fe2559f5e86bcc7d88fe611b71942faa73e787afbc2126a601662ab254a36fc.js` to find GraphQL query shapes.
3. POST the `getRecentTicketsQuery` with `variables:{"domain":"ok.myshopify.com"}` to `https://athena-flex-production.shopifycloud.com/graphql`.
4. Read the 9,259-byte JSON response containing ticket id, requester name, subject, description.
**How found:** Noticed the site returned 200 and loaded content before redirecting to Okta; used view-source to grab the JS bundle, beautified it, and found GraphQL query strings and an API key, then probed the /graphql endpoint.
**Exploitation:** Unauthenticated attacker sends a crafted GraphQL query naming any myshopify domain and receives that shop's Zendesk tickets including descriptions and requester names; also noted ability to create tickets as other agents and change ticket state.
**Insight:** When a login redirect happens client-side, the pre-redirect HTML/JS is still served unauthenticated — view-source and the JS bundle often reveal internal API endpoints and query shapes that skip the auth gate.