CVE-2026-50160

Hoppscotch is an API development ecosystem. In self-hosted deployments of hoppscotch-backend from version 2026.4.1 and earlier, the unauthenticated POST /v1/onboarding/config endpoint is vulnerable to mass assignment. The global NestJS ValidationPipe is configured without whitelist: true, so extra properties on the request body that are not declared in SaveOnboardingConfigRequest are not stripped and are iterated in the service layer as if they were legitimate InfraConfig entries. Because keys such as JWT_SECRET and SESSION_SECRET are valid InfraConfigEnum values and are not explicitly rejected during validation, an unauthenticated attacker who can reach a fresh instance before onboarding completes (or when no users exist) can overwrite these values in the database. Overwriting JWT_SECRET gives the attacker control of the JWT signing key, allowing them to forge tokens for any user, including administrators, and results in full server compromise. The issue is fixed in hoppscotch 2026.5.0.

• CWE-915

• https://github.com/hoppscotch/hoppscotch/pull/6171Issue Tracking, Patch
• https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-j542-4rch-8hwfExploit, Mitigation, Vendor Advisory
• https://www.openwall.com/lists/oss-security/2026/06/23/7Exploit, Mailing List, Third Party Advisory
• https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-j542-4rch-8hwfExploit, Mitigation, Vendor Advisory

Published

Jul 1, 2026

Last Modified

Jul 2, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-50151oras-go is a Go library for managing OCI artifacts. Prior to…7.5
• CVE-2026-50152Ceph is an open-source distributed storage platform providin…9.1
• CVE-2026-50157Auth0 Symfony is a Symfony SDK for Auth0 Authentication and …6.5
• CVE-2026-50158yutu is an AI-powered toolkit for managing and growing YouTu…7.7
• CVE-2026-50159Mermaid is a JavaScript tool that uses Markdown-inspired tex…5.3
• CVE-2026-5016A vulnerability was identified in elecV2 elecV2P up to 3.8.3…7.3
• CVE-2026-50161libre is a generic library for real-time communications with…9.3
• CVE-2026-50162oras-go is a Go library for managing OCI artifacts. Prior to…6.9
• CVE-2026-50163oras-go is a Go library for managing OCI artifacts. Prior to…7.1
• CVE-2026-50165alf.io is an open source ticket reservation system for confe…7.1
• CVE-2026-50166Kuma is a modern Envoy-based service mesh that can run on ev…5.5
• CVE-2026-50167Kurrier is a modern, self-hosted workspace for email, calend…5.3