iframe loaded from official admin URL, shop param: unknown
| attacker session id (shop A user 42) | unknown_42 |
| upstream loader: id.split("_").last | 42 |
| storage lookup by bare user id | retrieve_by_shopify_user_id(42) |
| returned session (shop B!) | shop-B.myshopify.com | token=at_VICTIM_*** |
| attacker can now read | 1,337 victim orders |
Proof beacon fired to collector from official admin iframe.