Hoppscotch <= 2026.4.1 - Mass Assignment JWT_SECRET Overwrite

criticalseverity

10CVSS score

1.7%likelihood of exploitation, next 30 days

78%of all CVEs are less likely

Readycheck to confirm it

Hoppscotch self-hosted backend <= 2026.4.1 contains a broken authentication caused by mass assignment via unauthenticated POST /v1/onboarding/config endpoint, letting unauthenticated attackers overwrite JWT_SECRET to forge tokens and fully compromise the server, exploit requires attacker to access fresh instance before onboarding completes or when no users exist.

Impact

Unauthenticated attackers can forge JWT tokens and fully compromise the server, including administrator access.

Fix

Update to version 2026.5.0 or later.

How to confirm it

Send: GET /v1/onboarding/status
Positive when: status_code == 200 and contains(body, "canReRunOnboarding") and contains(body, "\"onboardingCompleted\":false") || contains(body, "\"canReRunOnboarding\":true")
Send: POST /v1/onboarding/config
Positive when: status_code == 400 and contains(body, "VITE_ALLOWED_AUTH_PROVIDERS") and !contains(body, "should not exist")

Run it with nuclei: nuclei -id CVE-2026-50160 -u <target>

The full check

id: CVE-2026-50160

info:
  name: Hoppscotch <= 2026.4.1 - Mass Assignment JWT_SECRET Overwrite
  author: str4k3r
  severity: critical
  description: |
    Hoppscotch self-hosted backend <= 2026.4.1 contains a broken authentication caused by mass assignment via unauthenticated POST /v1/onboarding/config endpoint, letting unauthenticated attackers overwrite JWT_SECRET to forge tokens and fully compromise the server, exploit requires attacker to access fresh instance before onboarding completes or when no users exist.
  impact: |
    Unauthenticated attackers can forge JWT tokens and fully compromise the server, including administrator access.
  remediation: |
    Update to version 2026.5.0 or later.
  reference:
    - https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-j542-4rch-8hwf
    - https://nvd.nist.gov/vuln/detail/CVE-2026-50160
    - https://github.com/hoppscotch/hoppscotch/pull/6171
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
    cvss-score: 10.0
    cve-id: CVE-2026-50160
    epss-score: 0.01701
    epss-percentile: 0.7742
    cwe-id: CWE-915
  metadata:
    verified: true
    max-request: 2
    vendor: hoppscotch
    product: hoppscotch
    shodan-query: http.title:"Hoppscotch"
    fofa-query: title="Hoppscotch"
  tags: cve,cve2026,hoppscotch,mass-assignment,jwt

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /v1/onboarding/status HTTP/1.1
        Host: {{Hostname}}
        Accept: application/json

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "canReRunOnboarding")'
          - 'contains(body, "\"onboardingCompleted\":false") || contains(body, "\"canReRunOnboarding\":true")'
        condition: and
        internal: true

  - raw:
      - |
        POST /v1/onboarding/config HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        Accept: application/json

        {"CVE_2026_50160_DETECT":"true"}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 400'
          - 'contains(body, "VITE_ALLOWED_AUTH_PROVIDERS")'
          - '!contains(body, "should not exist")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from