CVE-2026-50160: Hoppscotch is an API development ecosystem. In self-hosted deployments of hoppscotch-backend from version 2026.4.1 and earlier, the unauthenticated POST…

PriorityP180critical10CVSS 3.1

AVNACLPRNUINSCCHIHAN

EXPLOIT

EPSS

1.70%

75.2th percentile

Hoppscotch is an API development ecosystem. In self-hosted deployments of hoppscotch-backend from version 2026.4.1 and earlier, the unauthenticated POST /v1/onboarding/config endpoint is vulnerable to mass assignment. The global NestJS ValidationPipe is configured without whitelist: true, so extra properties on the request body that are not declared in SaveOnboardingConfigRequest are not stripped and are iterated in the service layer as if they were legitimate InfraConfig entries. Because keys such as JWT_SECRET and SESSION_SECRET are valid InfraConfigEnum values and are not explicitly rejected during validation, an unauthenticated attacker who can reach a fresh instance before onboarding completes (or when no users exist) can overwrite these values in the database. Overwriting JWT_SECRET gives the attacker control of the JWT signing key, allowing them to forge tokens for any user, including administrators, and results in full server compromise. The issue is fixed in hoppscotch 2026.5.0.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
hoppscotch	hoppscotch	< 2026.5.0	2026.5.0
hoppscotch	hoppscotch	<= 2026.4.1	—

Detection & IOCsextracted from sources · hover to see the quote

urlPOST /v1/onboarding/config↗

→Monitor for unauthenticated POST requests to /v1/onboarding/config containing extra body properties beyond the expected DTO fields, especially keys matching InfraConfigEnum values such as JWT_SECRET or SESSION_SECRET. ↗
→Alert on unauthenticated requests to the onboarding endpoint when users already exist or onboarding has already completed, as exploitation requires reaching the instance before onboarding completes or when no users exist. ↗
→Detect mass assignment exploitation via Object.entries(dto) iteration in the NestJS service layer — look for unexpected keys passed through the ValidationPipe to the service layer in hoppscotch-backend logs. ↗
→Treat any JWT tokens issued after an unexpected JWT_SECRET or SESSION_SECRET database update as potentially forged; monitor for admin-level JWT tokens appearing after unauthenticated access to the onboarding endpoint. ↗
→Flag exploitation attempts that survive password resets — persistence via overwritten JWT_SECRET/SESSION_SECRET in the database means credential resets alone do not remediate compromise. ↗

·The vulnerability only affects self-hosted hoppscotch-backend deployments; cloud-hosted instances are not impacted. ↗
·Exploitation is gated on the instance being in an onboarding state (no users yet exist); already fully onboarded instances with existing users may not be exploitable via this path. ↗
·The root cause is the global NestJS ValidationPipe being configured without whitelist: true; patched in version 2026.5.0. ↗
·Four independent weaknesses are chained to achieve exploitation in a single HTTP request with no credentials required. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.