Is CVE-2026-34931 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34931 being exploited in the wild.

How severe is CVE-2026-34931?

Critical severity, with a CVSS score of 9.6, published 2 April 2026.

Which products and versions are affected?

hoppscotch hoppscotch-backend <= 2026.2.1.

Is there a fix for CVE-2026-34931?

A patch was published on 2026-03-31: Version 2026.3.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34931 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-34931?

Check whether you run Hoppscotch. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34931: Hoppscotch open redirect and token exfiltration in device-login flow

Q: Is there a fix for CVE-2026-34931?

A patch was published on 2026-03-31: Version 2026.3.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-34931 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-34931?

Check whether you run Hoppscotch. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34931 · Severity: critical · CVSS 9.6 · Published 2026-04-02

Hoppscotch is an open-source platform used by developers to build and test APIs. A security flaw in the login process allows attackers to redirect users to a malicious website during the sign-in phase. If a user is tricked into clicking a malicious link, the attacker can steal their login tokens and take full control of their account, potentially accessing sensitive API data and organizational workspaces.

Technologies: Hoppscotch. Vendors: Hoppscotch.

Quick answers

Is CVE-2026-34931 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34931 being exploited in the wild.
How severe is CVE-2026-34931?: Critical severity, with a CVSS score of 9.6, published 2 April 2026.
Which products and versions are affected?: hoppscotch hoppscotch-backend <= 2026.2.1.
Is there a fix for CVE-2026-34931?: A patch was published on 2026-03-31: Version 2026.3.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34931 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-34931?: Check whether you run Hoppscotch. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An open redirect vulnerability exists in the Hoppscotch backend's device-login flow due to improper validation of the 'redirect_uri' parameter. Specifically, the system fails to properly validate loopback addresses, allowing an attacker to bypass checks using DNS wildcard techniques (e.g., localhost.attacker-domain.com). When a victim navigates to a crafted URL and clicks 'Proceed', their access and refresh tokens are appended to the redirect URI and sent to the attacker-controlled server. This allows the attacker to exfiltrate authentication tokens and perform a full account takeover. The issue is fixed in version 2026.3.0 by improving redirect URI validation.

Affected products

hoppscotch hoppscotch-backend <= 2026.2.1

Timeline

2026-03-31: patched: Version 2026.3.0 released
2026-03-31: advisory: GitHub Security Advisory published
2026-04-02: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.