CVE-2026-50160

Hoppscotch is an API development ecosystem. In self-hosted deployments of hoppscotch-backend from version 2026.4.1 and earlier, the unauthenticated POST /v1/onboarding/config endpoint is vulnerable to mass assignment. The global NestJS ValidationPipe is configured without whitelist: true, so extra properties on the request body that are not declared in SaveOnboardingConfigRequest are not stripped and are iterated in the service layer as if they were legitimate InfraConfig entries. Because keys such as JWT_SECRET and SESSION_SECRET are valid InfraConfigEnum values and are not explicitly rejected during validation, an unauthenticated attacker who can reach a fresh instance before onboarding completes (or when no users exist) can overwrite these values in the database. Overwriting JWT_SECRET gives the attacker control of the JWT signing key, allowing them to forge tokens for any user, including administrators, and results in full server compromise. The issue is fixed in hoppscotch 2026.5.0.

• CWE-915

• https://github.com/hoppscotch/hoppscotch/pull/6171Issue Tracking, Patch
• https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-j542-4rch-8hwfExploit, Mitigation, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2026/06/23/7Exploit, Mailing List, Third Party Advisory
• https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-j542-4rch-8hwfExploit, Mitigation, Vendor Advisory

Published

Jul 1, 2026

Last Modified

Jul 2, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-50147Metabase is an open-source business intelligence and embedde…7.6
• CVE-2026-50148Metabase is an open-source business intelligence and embedde…9.1
• CVE-2026-5015A vulnerability was determined in elecV2 elecV2P up to 3.8.3…4.3
• CVE-2026-50151oras-go is a Go library for managing OCI artifacts. Prior to…7.5
• CVE-2026-50159Mermaid is a JavaScript tool that uses Markdown-inspired tex…5.3
• CVE-2026-5016A vulnerability was identified in elecV2 elecV2P up to 3.8.3…7.3
• CVE-2026-50162oras-go is a Go library for managing OCI artifacts. Prior to…6.9
• CVE-2026-50163oras-go is a Go library for managing OCI artifacts. Prior to…7.1
• CVE-2026-50168Angular is a development platform for building mobile and de…8.2
• CVE-2026-50169Angular is a development platform for building mobile and de…6.1
• CVE-2026-5017A security flaw has been discovered in code-projects Simple …9.8
• CVE-2026-50170Angular is a development platform for building mobile and de…7.5