# CVE-2026-50160: Hoppscotch mass assignment in onboarding config endpoint

Source: https://junglewise.ai/threats/cve-2026-50160-hoppscotch-mass-assignment-in-onboarding-config-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-01. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-50160 · Severity: critical · CVSS 10 · Published 2026-07-01

A critical vulnerability exists in Hoppscotch, a popular tool for API development, specifically affecting self-hosted deployments. An attacker can exploit a flaw in the initial setup process to overwrite the system's security keys without needing a password. This allows the attacker to forge administrative credentials, leading to a total takeover of the server and access to all user data.

Technologies: [Hoppscotch](https://junglewise.ai/threats/technologies/hoppscotch). Vendors: [Hoppscotch](https://junglewise.ai/threats/vendors/hoppscotch).

## Quick answers

**Is CVE-2026-50160 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50160 being exploited in the wild.

**How severe is CVE-2026-50160?** Critical severity, with a CVSS score of 10, published 1 July 2026.

**Which products and versions are affected?** Hoppscotch <= 2026.4.1.

**Is there a fix for CVE-2026-50160?** A patch was published on 2026-04-21: Initial pull request for fix submitted Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50160 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-50160?** Check whether you run Hoppscotch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A mass assignment vulnerability exists in the 'POST /v1/onboarding/config' endpoint of hoppscotch-backend. The root cause is a combination of four weaknesses: the NestJS ValidationPipe is configured without 'whitelist: true', allowing extra request body properties to persist; the service layer iterates through these properties using 'Object.entries' without runtime validation; the 'validateEnvValues' function lacks explicit checks for sensitive keys (falling through to a default break); and the endpoint lacks authentication. An unauthenticated remote attacker can exploit this on fresh installations (where no users exist) to overwrite 'JWT_SECRET' and 'SESSION_SECRET'. By controlling the JWT signing key, the attacker can forge tokens for any user, including administrators, achieving full remote code execution or server compromise. The issue is resolved in version 2026.5.0 by enabling strict validation whitelisting and service-level allowlists.

## Affected products

- Hoppscotch hoppscotch-backend (Self-Hosted) <= 2026.4.1

## Timeline

- 2026-04-21: patched: Initial pull request for fix submitted
- 2026-05-28: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: Public disclosure on oss-security mailing list
- 2026-07-01: advisory: NVD publication date

## References

- [https://github.com/hoppscotch/hoppscotch/pull/6171](https://github.com/hoppscotch/hoppscotch/pull/6171)
- [https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-j542-4rch-8hwf](https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-j542-4rch-8hwf)
- [http://www.openwall.com/lists/oss-security/2026/06/23/7](http://www.openwall.com/lists/oss-security/2026/06/23/7)

## Related threats

- [Hoppscotch insecure default configuration in mock server creation](https://junglewise.ai/threats/cve-2026-59720-hoppscotch-insecure-default-configuration-in-mock-server-creation)
- [Hoppscotch stored XSS in mock server responses](https://junglewise.ai/threats/cve-2026-34932-hoppscotch-stored-xss-in-mock-server-responses)
- [Hoppscotch open redirect and token exfiltration in device-login flow](https://junglewise.ai/threats/cve-2026-34931-hoppscotch-open-redirect-and-token-exfiltration-in-device-login)
- [Hoppscotch stored XSS in team member overflow tooltip](https://junglewise.ai/threats/cve-2026-34848-hoppscotch-stored-xss-in-team-member-overflow-tooltip)
- [Hoppscotch open redirect in /enter page](https://junglewise.ai/threats/cve-2026-34847-hoppscotch-open-redirect-in-enter-page)