Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Hoppscotch is an API development ecosystem. In self-hosted deployments of hoppscotch-backend from version 2026.4.1 and earlier, the unauthenticated POST /v1/onboarding/config endpoint is vulnerable to mass assignment. The global NestJS ValidationPipe is configured without whitelist: true, so extra properties on the request body that are not declared in SaveOnboardingConfigRequest are not stripped and are iterated in the service layer as if they were legitimate InfraConfig entries. Because keys such as JWT_SECRET and SESSION_SECRET are valid InfraConfigEnum values and are not explicitly rejected during validation, an unauthenticated attacker who can reach a fresh instance before onboarding completes (or when no users exist) can overwrite these values in the database. Overwriting JWT_SECRET gives the attacker control of the JWT signing key, allowing them to forge tokens for any user, including administrators, and results in full server compromise. The issue is fixed in hoppscotch 2026.5.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-06-23 | 1 | Disclosure1 |
| 2026-06-25 | 1 | Disclosure1 |
| 2026-06-29 | 3 | Disclosure1Patch2 |
| 2026-07-07 | 1 | Patch1 |
| 2026-07-19 | 1 | Disclosure1 |
| 2026-08-13 | 1 | Disclosure1 |
CVE-2026-50160: Four Independent Weaknesses Combine Into a CVSS 10.0 Full Compromise in Hoppscotch https://www.offgridsec.com/blog-hoppscotch-cve-2026-50160.html
Post summary
The blog post announces CVE‑2026‑50160, detailing four independent weaknesses that collectively lead to a CVSS 10.0 full compromise in Hoppscotch.
A CVSS 10 Hoppscotch mass assignment flaw leads to full server compromise. Unauthenticated attackers can exploit CVE-2026-50160 to overwrite JWT secrets. #Hoppscotch #CVE202650160 #MassAssignment #CyberSecurity #AppSec https://securityonline.info/hoppscotch-mass-assignment https://t.co/1Rso72QB2i
Post summary
The tweet briefly announces a CVSS 10 mass assignment vulnerability (CVE‑2026‑50160) in Hoppscotch that allows attackers to overwrite JWT secrets, but no PoC, exploit, patch or active exploitation details are provided.
CVE-2026-50160: Hoppscotch: Unauthenticated JWT Secret Overwrite https://www.openwall.com/lists/oss-security/2026/06/23/7 CVSS 10. Four independent weaknesses combine to enable this. PoC included. Fixed in 2026.5.0. Hoppscotch is an open source self-hosted API development platform (79,000+ GitHub stars).
Post summary
A high‑severity vulnerability (CVSS 10) was disclosed that allows unauthenticated overwriting of the JWT secret in Hoppscotch. A proof‑of‑concept was included and the issue is fixed in version 2026.5.0.
🚨 CVE-2026-50160 - critical 🚨 Hoppscotch <= 2026.4.1 - Mass Assignment JWT_SECRET Overwrite > Hoppscotch self-hosted backend <= 2026.4.1 contains a broken authentication caused by... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-50160 @pdnuclei #NucleiTemplates #cve
Post summary
The post announces CVE-2026-50160, a critical broken authentication flaw in Hoppscotch <= 2026.4.1 via mass assignment of JWT_SECRET, and links to a detection template.
Hoppscotch の脆弱性 CVE-2026-50160 が FIX：JWT_SECRET の上書きと Admin Token の生成 https://iototsecnews.jp/2026/06/29/critical-hoppscotch-vulnerability-lets-attackers-overwrite-jwt_secret-and-forge-admin-tokens/ API 検証ツール Hoppscotch の管理機能において、外部入力のチェック不足により内部の重要設定を書き換えられる脆弱性 CVE-2026-50160 が見つかりました。導入直後の初期設定段階で適切な認証が行われず、入力データの検証にも漏れがあったことが原因です。悪用されると、JWT_SECRET などの秘匿すべき鍵を変更され、管理者権限を奪取される恐れがあります。対象ツールを最新版へ更新し、不要な外部公開を避ける防護策が必要です。 #CVE202650160 #Hoppscotch #Vulnerability
Post summary
Hoppscotch discovered to have CVE‑2026‑50160, enabling overwriting of JWT_SECRET and forging admin tokens; updating to the latest version is recommended to mitigate the risk.
⚠️ CVSS 10.0 in Hoppscotch (CVE-2026-50160) — mass assignment flaw = full server takeover, no auth needed. Dev teams running self-hosted instances: patch NOW. https://securityonline.info/hoppscotch-mass-assignment/ #cybersecurity #APISecurity #DevSecOps
Post summary
CVE‑2026‑50160 is a critical mass‑assignment flaw in self‑hosted Hoppscotch installations that allows attackers to take over a server without authentication; a patch is urgently required.
⚠️ A critical flaw (CVE-2026-50160) in self-hosted Hoppscotch could let unauthenticated attackers take over servers by overwriting JWT secrets. Upgrade to version 2026.5.0 immediately. #CyberSecurity #DevSecOps Read more: https://thecyberedition.com/critical-hoppscotch-bug-enables-full-server-takeover-patch-now/
Post summary
The tweet announces a critical CVE (CVE-2026-50160) in Hoppscotch, highlights the vulnerability’s remote takeover potential, and urges users to upgrade to patch version 2026.5.0 immediately.
CVE-2026-50160: Hoppscotch Self-Hosted Onboarding Mass Assignment Bug - What It Means for Your Business and How to Respond https://hubs.li/Q04pZkKk0
Post summary
The snippet announces CVE‑2026‑50160, a mass‑assignment vulnerability in Hoppscotch Self‑Hosted onboarding, without providing PoC, exploit details, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | hoppscotch | hoppscotch | - | - | - |