# Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege Escalation to Any Shop Owner by Taking Advantage of the Shopify SSO

Shopify sent the new-email confirmation link to the old signup address, letting an attacker confirm any email and use SSO to seize all stores under it.

- Payout: hidden
- Severity: critical
- Program: Shopify
- Found by: ngalog
- Disclosed: 2020-04-01
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/791775
- Library page: https://bugbountylibrary.com/r/h1%3A791775
- Tags: area:web domain:web impact:ato impact:privesc kind:bounty platform:hackerone sev:critical technique:chained vuln:account-takeover vuln:auth-bypass vuln:business-logic

**Target:** myshopify.com email-change confirmation and SSO integration
**Root cause:** On email change, the confirmation link for the new address was mailed to the previously stored (attacker-controlled) address instead of the new one, so the attacker could confirm an email they don't own.
**Steps:**
1. Sign up for a free trial at `https://www.shopify.com/pricing` with `attacker@gmail.com`.
2. Go to Your Profile and change email to victim's address, e.g. `yaworsk@hackerone.com`, save.
3. Wait for mail from `mailer@shopify.com`; confirmation link for the new address arrives at `attacker@gmail.com`.
4. Click the link; email is now updated to the victim's address.
5. In profile, accept the SSO integration prompt for other accounts sharing that email and set a master password to take over all stores.
**How found:** Noticed the email-change flow sent the confirmation to the old address; hypothesized the system tracked the stale email and tested by changing to an address they didn't control, then checked the victim store's owner email to confirm.
**Exploitation:** Attacker registers a trial, changes profile email to a victim's address, receives the confirmation link at their own inbox, confirms it, then uses Shopify's SSO account-integration feature to set a master password covering every store under that email — full takeover of all victim stores.
**Escalation:** Single email-confirmation bypass chained into SSO master-password reset to escalate from one account to every store sharing the victim email.
**Insight:** When a flow changes an identity attribute, check which stored value the verification message is keyed to — a stale-address confirmation lets you claim emails you don't own; then look for SSO/account-linking features that trust that email as the identity anchor.