Executive brief
Hoppscotch is an open-source platform used by developers to build and test APIs. A security flaw in the login process allows attackers to redirect users to a malicious website during the sign-in phase. If a user is tricked into clicking a malicious link, the attacker can steal their login tokens and take full control of their account, potentially accessing sensitive API data and organizational workspaces.
Technical details
An open redirect vulnerability exists in the Hoppscotch backend's device-login flow due to improper validation of the 'redirect_uri' parameter. Specifically, the system fails to properly validate loopback addresses, allowing an attacker to bypass checks using DNS wildcard techniques (e.g., localhost.attacker-domain.com). When a victim navigates to a crafted URL and clicks 'Proceed', their access and refresh tokens are appended to the redirect URI and sent to the attacker-controlled server. This allows the attacker to exfiltrate authentication tokens and perform a full account takeover. The issue is fixed in version 2026.3.0 by improving redirect URI validation.
Affected products
- hoppscotch hoppscotch-backend <= 2026.2.1
Timeline
- 2026-03-31: patched: Version 2026.3.0 released
- 2026-03-31: advisory: GitHub Security Advisory published
- 2026-04-02: disclosed: CVE published to NVD