by Kastro
Paper/Archive/CVE-2026-34931

CVE-2026-34931

hoppscotch hoppscotch — hoppscotch: Improper loopback redirect_uri validation in device-login flow

EPSS 0.4%public exploitCVSS 9.6
critical.is priorityof 100
45
CVSS 9.6 (NVD)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 32.0.320 × 206.4Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, there is an open redirect vulnerability that leads to token exfiltration. With these tokens, the attacker can sign in as the victim to takeover their account. This issue has been patched in version 2026.3.0.

Affected

ProductAffectedFixed inSource
hoppscotch< 2026.3.0–CNA

Scores by source

NVD9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
GitHub_M (CNA)8.5CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refgithub.com/hoppscotch/hoppscotch/security/advisories/GHSA-7fg7-wx5q-6m3vrefgithub.com/hoppscotch/hoppscotch/releases/tag/2026.3.0