Is CVE-2026-34847 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34847 being exploited in the wild.

How severe is CVE-2026-34847?

Medium severity, with a CVSS score of 4.7, published 2 April 2026.

Is there a fix for CVE-2026-34847?

A patch was published on 2026-03-31: Version 2026.3.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34847 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-34847?

Check whether you run Hoppscotch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34847: Hoppscotch open redirect in /enter page

CVE-2026-34847 · Severity: medium · CVSS 4.7 · Published 2026-04-02

Hoppscotch is an open-source platform used by developers to build and test APIs. A security flaw in the login page allows attackers to create malicious links that look legitimate but automatically redirect users to external, untrusted websites. This could be used in phishing campaigns to trick users into visiting fake login pages or downloading malware.

Technologies: Hoppscotch. Vendors: Hoppscotch.

Quick answers

Is CVE-2026-34847 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34847 being exploited in the wild.
How severe is CVE-2026-34847?: Medium severity, with a CVSS score of 4.7, published 2 April 2026.
Which products and versions are affected?: Hoppscotch < 2026.3.0.
Is there a fix for CVE-2026-34847?: A patch was published on 2026-03-31: Version 2026.3.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34847 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-34847?: Check whether you run Hoppscotch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A DOM-based open redirect vulnerability exists in the Hoppscotch web frontend within the `/enter` page component (`enter.vue`). The application extracts the `redirect` query parameter and uses it to construct a new URL object without validating the destination domain. Specifically, the `mounted()` lifecycle hook takes the user-controlled input, appends additional query parameters, and assigns the result directly to `window.location.href`. An attacker can exploit this by crafting a URL that redirects a victim to a malicious site. This issue is patched in version 2026.3.0 by implementing proper validation of the redirect target.

Affected products

Hoppscotch Hoppscotch < 2026.3.0

Timeline

2026-03-31: patched: Version 2026.3.0 released
2026-03-31: advisory: GitHub Security Advisory GHSA-27pm-c9ch-746q published
2026-04-02: disclosed: CVE-2026-34847 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.