# Able to Takeover Merchants Accounts Even They Have Already Setup SSO, After Bypassing the Email Confirmation

After bypassing email confirmation, an attacker could swap the /login path to /accounts_merge/new-password during account merge to reset a SSO merchant's password and take over the store.

- Payout: hidden
- Severity: medium
- Program: Shopify
- Found by: ngalog
- Disclosed: 2020-04-01
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/796956
- Library page: https://bugbountylibrary.com/r/h1%3A796956
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:medium tech:sso technique:chained vuln:access-control vuln:account-takeover vuln:auth-bypass

**Target:** accounts.shopify.com account merge flow
**Root cause:** The account-merge flow's master-password gate at /login could be bypassed by rewriting the URL path to /accounts_merge/new-password while keeping the query string, letting the attacker set a new password without knowing the victim's master password.
**Steps:**
1. Create a store and confirm email using victim's email (victim has SSO set up, no 2FA)
2. Click the 'Review accounts' button in the shop
3. Enter your own store's password to authenticate
4. At accounts.shopify.com/login?xxxxxx, change `/login` to `/accounts_merge/new-password` keeping query part the same
5. Enter a new password of attacker's choice, skip 2FA setup
6. Click confirm on the password change page
7. Switch stores or log in to victim's store with the new password
**How found:** After reading a comment that the prior bug only affected accounts not yet on the single login system, the researcher deliberately probed the account-merge flow to find a way around the master-password requirement, noticing the /login path and trying /accounts_merge/new-password with the same query string.
**Exploitation:** Attacker first bypasses email confirmation (per prior report #791775), signs up a store with the victim's email, triggers the account merge review, authenticates with their own store password, then rewrites the master-password prompt URL from /login to /accounts_merge/new-password to set a new password on the victim account, gaining full store access.
**Escalation:** Chains with the email-confirmation bypass from #791775 to extend takeover from non-SSO accounts to SSO-enabled merchants.
**Insight:** In multi-step account-merge or SSO-linking flows, the step that asks for the master password is often just a URL-gated page; try swapping the path to sibling endpoints (e.g. new-password) while preserving the query token to skip the credential check.