Executive brief
Hoppscotch is an open-source platform used by developers to build and test APIs. A security flaw in self-hosted versions allows unauthenticated attackers to download sensitive infrastructure secrets, such as OAuth credentials and email server passwords, in plain text. This occurs when the system is configured using environment variables, leaving a recovery token empty and accessible to anyone on the network.
Technical details
The vulnerability exists in the GET /v1/onboarding/config endpoint of the Hoppscotch backend. When an instance is configured via environment variables rather than the onboarding wizard, the ONBOARDING_RECOVERY_TOKEN in the database is initialized as an empty string. The NestJS @Query('token') decorator parses a request with an empty token parameter (e.g., ?token=) as an empty string, causing a comparison check in infra-config.service.ts to evaluate as true. Because the endpoint lacks authentication guards, any network-reachable attacker can bypass the token check to retrieve sensitive configuration data, including OAuth client secrets and SMTP credentials. This issue was addressed in version 2026.4.0.
Affected products
- Hoppscotch Hoppscotch Backend (Self-Hosted) >= 2025.7.0, < 2026.4.0
Timeline
- 2026-04-30: advisory: GitHub Security Advisory published
- 2026-05-13: disclosed: CVE published to NVD
- 2026-04-30: patched: Fixed in version 2026.4.0