CVE-2026-34931
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Hoppscotch prior to version 2026.3.0 has an open redirect vulnerability that leads to token exfiltration. With these tokens, the attacker can sign in as the victim to takeover their account.
Risk Assessment
An attacker can take over the victim's account, gaining access to sensitive data and functions available to the logged-in user.
Recommendation
Update Hoppscotch to version 2026.3.0 or later, which includes a fix for the open redirect vulnerability.
Original NVD description (English source)
hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, there is an open redirect vulnerability that leads to token exfiltration. With these tokens, the attacker can sign in as the victim to takeover their account. This issue has been patched in version 2026.3.0.