CVE-2026-34847
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
In hoppscotch before version 2026.3.0, the /enter page contains a DOM-based open redirect vulnerability. The redirect query parameter is directly used to construct a URL and redirect the user without proper validation.
Risk Assessment
An attacker can exploit this vulnerability to redirect users to a malicious site, potentially leading to data theft or malware installation.
Recommendation
Update hoppscotch to version 2026.3.0 or later.
Original NVD description (English source)
hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, the /enter page contains a DOM-based open redirect vulnerability. The redirect query parameter is directly used to construct a URL and redirect the user without proper validation. This issue has been patched in version 2026.3.0.