Skip to content
OpenAdvisories

Vendor

hoppscotch

18 known vulnerabilities.

Products

hoppscotch 16 hoppscotch-extension 1 hoppscotch/hoppscotch 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 10.0
    CVE-2026-50160 Scanner template

    Mass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET Overwrite

    Hoppscotch is an API development ecosystem. In self-hosted deployments of hoppscotch-backend from version 2026.4.1 and earlier, the unauthenticated POST /v1/onboarding/config endpoint is vulnerable to mass assignment. The global NestJS ValidationPipe is confi…

    hoppscotch hoppscotch
  • Critical 9.1
    CVE-2026-28215

    hoppscotch Vulnerable to Unauthenticated Onboarding Config Takeover

    hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, an unauthenticated attacker can overwrite the entire infrastructure configuration of a self-hosted Hoppscotch instance including OAuth provider credentials and SMTP settings by…

    hoppscotch hoppscotch