# CVE-2026-34931: Hoppscotch open redirect and token exfiltration in device-login flow

Source: https://junglewise.ai/threats/cve-2026-34931-hoppscotch-open-redirect-and-token-exfiltration-in-device-login  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-02. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-34931 · Severity: critical · CVSS 9.6 · Published 2026-04-02

Hoppscotch is an open-source platform used by developers to build and test APIs. A security flaw in the login process allows attackers to redirect users to a malicious website during the sign-in phase. If a user is tricked into clicking a malicious link, the attacker can steal their login tokens and take full control of their account, potentially accessing sensitive API data and organizational workspaces.

Technologies: [Hoppscotch](https://junglewise.ai/threats/technologies/hoppscotch). Vendors: [Hoppscotch](https://junglewise.ai/threats/vendors/hoppscotch).

## Quick answers

**Is CVE-2026-34931 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34931 being exploited in the wild.

**How severe is CVE-2026-34931?** Critical severity, with a CVSS score of 9.6, published 2 April 2026.

**Which products and versions are affected?** hoppscotch hoppscotch-backend <= 2026.2.1.

**Is there a fix for CVE-2026-34931?** A patch was published on 2026-03-31: Version 2026.3.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34931 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-34931?** Check whether you run Hoppscotch. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An open redirect vulnerability exists in the Hoppscotch backend's device-login flow due to improper validation of the 'redirect_uri' parameter. Specifically, the system fails to properly validate loopback addresses, allowing an attacker to bypass checks using DNS wildcard techniques (e.g., localhost.attacker-domain.com). When a victim navigates to a crafted URL and clicks 'Proceed', their access and refresh tokens are appended to the redirect URI and sent to the attacker-controlled server. This allows the attacker to exfiltrate authentication tokens and perform a full account takeover. The issue is fixed in version 2026.3.0 by improving redirect URI validation.

## Affected products

- hoppscotch hoppscotch-backend <= 2026.2.1

## Timeline

- 2026-03-31: patched: Version 2026.3.0 released
- 2026-03-31: advisory: GitHub Security Advisory published
- 2026-04-02: disclosed: CVE published to NVD

## References

- [https://github.com/hoppscotch/hoppscotch/releases/tag/2026.3.0](https://github.com/hoppscotch/hoppscotch/releases/tag/2026.3.0)
- [https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-7fg7-wx5q-6m3v](https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-7fg7-wx5q-6m3v)

## Related threats

- [Hoppscotch insecure default configuration in mock server creation](https://junglewise.ai/threats/cve-2026-59720-hoppscotch-insecure-default-configuration-in-mock-server-creation)
- [Hoppscotch mass assignment in onboarding config endpoint](https://junglewise.ai/threats/cve-2026-50160-hoppscotch-mass-assignment-in-onboarding-config-endpoint)
- [Hoppscotch stored XSS in mock server responses](https://junglewise.ai/threats/cve-2026-34932-hoppscotch-stored-xss-in-mock-server-responses)
- [Hoppscotch stored XSS in team member overflow tooltip](https://junglewise.ai/threats/cve-2026-34848-hoppscotch-stored-xss-in-team-member-overflow-tooltip)
- [Hoppscotch open redirect in /enter page](https://junglewise.ai/threats/cve-2026-34847-hoppscotch-open-redirect-in-enter-page)