CVE-2026-34847 Details
Description
hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, the /enter page contains a DOM-based open redirect vulnerability. The redirect query parameter is directly used to construct a URL and redirect the user without proper validation. This issue has been patched in version 2026.3.0.
A DOM-based open redirect vulnerability has been identified in Hoppscotch versions prior to 2026.3.0. The issue arises on the '/enter' page, where the redirect query parameter is used to create a URL for redirection without adequate validation. This vulnerability can be exploited by crafting links that appear to originate from a legitimate Hoppscotch instance, potentially leading to phishing, credential theft, or interception of OAuth tokens.
Users can update to Hoppscotch version 2026.3.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/hoppscotch/hoppscotch/releases/tag/2026.3.0 | [email protected] | Release Notes |
| https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-27pm-c9ch-746q | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| hoppscotch hoppscotch | < 2026.3.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 15, 2026 | Initial Analysis | [email protected] |
| Apr 2, 2026 | New CVE Received | [email protected] |