Stealing livechat token and using it to chat as the user - user information disclosure

Hi , I have found an issue through which an attacker can steal users' livechat access token and use it to login and chat with the support agents as them , he also will be able to get access to sensitive user information such as his email and his first name and last name. Details: When you go to …

https://tasker-merchant-auth.herokuapp.com/auth/shopify/?utf8=%E2%9C%93&auth_type=chat&return_to=https%3A%2F%2Flivechat.shopify.com%2Fcustomer%2Fchats%2Fnew&shop=<shop>.myshopify.com