Critical severity · published Apr 2, 2026
CVE-2026-34931
hoppscotch: Improper loopback redirect_uri validation in device-login flow
9.6
CVSS
0.4%
EPSS
No
On KEV
Description
hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, there is an open redirect vulnerability that leads to token exfiltration. With these tokens, the attacker can sign in as the victim to takeover their account. This issue has been patched in version 2026.3.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HO
hoppscotch · hoppscotch
< 2026.3.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-34931
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-34931
Release Notes
https://github.com/hoppscotch/hoppscotch/releases/tag/2026.3.0
Exploit
https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-7fg7-wx5q-6m3v
More from hoppscotch
10.0
CVE-2026-50160
Mass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET Overwrite
9.3
CVE-2026-34932
hoppscotch: Stored XSS via mock server responses on backend origin
9.1
CVE-2026-28215
hoppscotch Vulnerable to Unauthenticated Onboarding Config Takeover
8.8
CVE-2023-34097
Database password exposed in logs in hoppscotch
8.3
CVE-2026-28216
hoppscotch has IDOR in updateUserEnvironment / deleteUserEnvironment