CVE-2026-50160 Details
Description
Hoppscotch is an API development ecosystem. In self-hosted deployments of hoppscotch-backend from version 2026.4.1 and earlier, the unauthenticated POST /v1/onboarding/config endpoint is vulnerable to mass assignment. The global NestJS ValidationPipe is configured without whitelist: true, so extra properties on the request body that are not declared in SaveOnboardingConfigRequest are not stripped and are iterated in the service layer as if they were legitimate InfraConfig entries. Because keys such as JWT_SECRET and SESSION_SECRET are valid InfraConfigEnum values and are not explicitly rejected during validation, an unauthenticated attacker who can reach a fresh instance before onboarding completes (or when no users exist) can overwrite these values in the database. Overwriting JWT_SECRET gives the attacker control of the JWT signing key, allowing them to forge tokens for any user, including administrators, and results in full server compromise. The issue is fixed in hoppscotch 2026.5.0.
A mass assignment vulnerability has been identified in self-hosted deployments of Hoppscotch prior to version 2026.4.1. The issue arises in the POST /v1/onboarding/config endpoint, which is accessible without authentication. The vulnerability allows an attacker to inject arbitrary InfraConfig keys, including JWT_SECRET and SESSION_SECRET, into the database. This is possible because the NestJS ValidationPipe does not strip unrecognized properties from the request body, enabling extra keys to be processed as legitimate config entries. Exploiting this vulnerability allows an attacker to overwrite critical secret values, with control over JWT_SECRET enabling the forgery of tokens for any user, including administrators, leading to a complete compromise of the server.
Upgrade to Hoppscotch version 2026.5.0. After updating, ensure that the ValidationPipe is configured with whitelist: true to strip unrecognized properties, and validate that only allowed keys are set via the onboarding endpoint.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-j542-4rch-8hwf | CISA-ADP | ExploitMitigationVendor Advisory |
| http://www.openwall.com/lists/oss-security/2026/06/23/7 | CVE | ExploitMailing ListThird Party Advisory |
| https://github.com/hoppscotch/hoppscotch/pull/6171 | [email protected] | Issue TrackingPatch |
| https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-j542-4rch-8hwf | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-915 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| hoppscotch hoppscotch | < 2026.5.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 2, 2026 | Initial Analysis | [email protected] |
| Jul 2, 2026 | CVE Modified | CISA-ADP |
| Jul 1, 2026 | New CVE Received | [email protected] |
| Jul 1, 2026 | CVE Modified | CISA-ADP |
| Jul 1, 2026 | CVE Modified | CVE |