CVE-2026-50160

CVE-2026-44478 vulnerability in hoppscotch allows unauthenticated users to access infrastructure secrets in plaintext via the GET /v1/onboarding/config endpoint when the ONBOARDING_RECOVERY_TOKEN is an empty string. This issue is fixed in version 2026.4.0.

Hoppscotch prior to version 2026.3.0 has a stored XSS vulnerability that can lead to CSRF.

Hoppscotch prior to version 2026.3.0 has an open redirect vulnerability that leads to token exfiltration. With these tokens, the attacker can sign in as the victim to takeover their account.

In Hoppscotch, an open source API development ecosystem, prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while toggleHistoryStarStatus and removeRequestFromHistory in the UserHistory service accept another user's history identifier without enforcing userUid ownership, allowing an authenticated workspace member to read private request history, session data, request contents, authorization headers, environment values, and settings and to modify or delete the victim's private history entries.

A vulnerability in Hoppscotch before version 2026.6.0 allows an admin to execute arbitrary commands as root in the backend container. The attack involves manipulating the MAILER_SMTP_URL parameter in the updateInfraConfigs GraphQL mutation, which is then parsed by nodemailer into sendmail transport options.

In Hoppscotch prior to version 2026.6.0, mock server creation in mock-server.service.ts does not persist the isPublic input field, while schema.prisma defaults isPublic to true. This causes mock servers linked to private collections to be publicly accessible without authentication, potentially exposing sensitive API data.

Hoppscotch, an open source API development ecosystem, contains a stored XSS vulnerability in the team member overflow tooltip via display name. This issue exists prior to version 2026.3.0.

In hoppscotch before version 2026.3.0, the /enter page contains a DOM-based open redirect vulnerability. The redirect query parameter is directly used to construct a URL and redirect the user without proper validation.

In versions prior to 2023.4.5, hoppscotch exposes the database password in logs when showing the database connection string. Attackers with access to system logs can gain full access to the database.