CVE-2026-34931

hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, there is an open redirect vulnerability that leads to token exfiltration. With these tokens, the attacker can sign in as the victim to takeover their account. This issue has been patched in version 2026.3.0.

• CWE-601

• https://github.com/hoppscotch/hoppscotch/releases/tag/2026.3.0Release Notes
• https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-7fg7-wx5q-6m3vExploit, Vendor Advisory

Published

Apr 2, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-3492The Gravity Forms plugin for WordPress is vulnerable to Stor…6.4
• CVE-2026-34926A directory traversal vulnerability in the Apex One (on-prem…6.7
• CVE-2026-34927An origin validation vulnerability in the Apex One/SEP agent…7.8
• CVE-2026-34928An origin validation vulnerability in the Apex One/SEP agent…7.8
• CVE-2026-34929An origin validation vulnerability in the Apex One/SEP agent…7.8
• CVE-2026-34930An origin validation vulnerability in the Apex One/SEP agent…7.8
• CVE-2026-34932hoppscotch is an open source API development ecosystem. Prio…9.3
• CVE-2026-34933Avahi is a system which facilitates service discovery on a l…5.5
• CVE-2026-34934PraisonAI is a multi-agent teams system. Prior to version 4.…9.8
• CVE-2026-34935PraisonAI is a multi-agent teams system. From version 4.5.15…9.8
• CVE-2026-34936PraisonAI is a multi-agent teams system. Prior to version 4.…7.7
• CVE-2026-34937PraisonAI is a multi-agent teams system. Prior to version 1.…9.8