Vulnerability · Published Apr 2, 2026 · Assigned by GitHub_M
CVE-2026-34931hoppscotch: Improper loopback redirect_uri validation in device-login flow
High 8.5
In plain English
A high-severity open redirect in hoppscotch from hoppscotch. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).
Severity (CVSS 4.0)8.5High
Exploit odds (30 days)0.4%top 67.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, there is an open redirect vulnerability that leads to token exfiltration. With these tokens, the attacker can sign in as the victim to takeover their account. This issue has been patched in version 2026.3.0.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| hoppscotch | hoppscotch | < 2026.3.0 |
Weakness: CWE-601 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-7fg7-wx5q-6m3v x_refsource_CONFIRM
- https://github.com/hoppscotch/hoppscotch/releases/tag/2026.3.0 x_refsource_MISC