# CVE-2026-34847: Hoppscotch open redirect in /enter page

Source: https://junglewise.ai/threats/cve-2026-34847-hoppscotch-open-redirect-in-enter-page  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-02. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-34847 · Severity: medium · CVSS 4.7 · Published 2026-04-02

Hoppscotch is an open-source platform used by developers to build and test APIs. A security flaw in the login page allows attackers to create malicious links that look legitimate but automatically redirect users to external, untrusted websites. This could be used in phishing campaigns to trick users into visiting fake login pages or downloading malware.

Technologies: [Hoppscotch](https://junglewise.ai/threats/technologies/hoppscotch). Vendors: [Hoppscotch](https://junglewise.ai/threats/vendors/hoppscotch).

## Quick answers

**Is CVE-2026-34847 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34847 being exploited in the wild.

**How severe is CVE-2026-34847?** Medium severity, with a CVSS score of 4.7, published 2 April 2026.

**Which products and versions are affected?** Hoppscotch < 2026.3.0.

**Is there a fix for CVE-2026-34847?** A patch was published on 2026-03-31: Version 2026.3.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34847 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-34847?** Check whether you run Hoppscotch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A DOM-based open redirect vulnerability exists in the Hoppscotch web frontend within the `/enter` page component (`enter.vue`). The application extracts the `redirect` query parameter and uses it to construct a new URL object without validating the destination domain. Specifically, the `mounted()` lifecycle hook takes the user-controlled input, appends additional query parameters, and assigns the result directly to `window.location.href`. An attacker can exploit this by crafting a URL that redirects a victim to a malicious site. This issue is patched in version 2026.3.0 by implementing proper validation of the redirect target.

## Affected products

- Hoppscotch Hoppscotch < 2026.3.0

## Timeline

- 2026-03-31: patched: Version 2026.3.0 released
- 2026-03-31: advisory: GitHub Security Advisory GHSA-27pm-c9ch-746q published
- 2026-04-02: disclosed: CVE-2026-34847 published to NVD

## References

- [https://github.com/hoppscotch/hoppscotch/releases/tag/2026.3.0](https://github.com/hoppscotch/hoppscotch/releases/tag/2026.3.0)
- [https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-27pm-c9ch-746q](https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-27pm-c9ch-746q)

## Related threats

- [Hoppscotch insecure default configuration in mock server creation](https://junglewise.ai/threats/cve-2026-59720-hoppscotch-insecure-default-configuration-in-mock-server-creation)
- [Hoppscotch mass assignment in onboarding config endpoint](https://junglewise.ai/threats/cve-2026-50160-hoppscotch-mass-assignment-in-onboarding-config-endpoint)
- [Hoppscotch stored XSS in mock server responses](https://junglewise.ai/threats/cve-2026-34932-hoppscotch-stored-xss-in-mock-server-responses)
- [Hoppscotch open redirect and token exfiltration in device-login flow](https://junglewise.ai/threats/cve-2026-34931-hoppscotch-open-redirect-and-token-exfiltration-in-device-login)
- [Hoppscotch stored XSS in team member overflow tooltip](https://junglewise.ai/threats/cve-2026-34848-hoppscotch-stored-xss-in-team-member-overflow-tooltip)