CVE-2026-34931

CRITICAL

hoppscotch: Improper loopback redirect_uri validation in device-login flow

Title source: cna
STIX 2.1

Description

hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, there is an open redirect vulnerability that leads to token exfiltration. With these tokens, the attacker can sign in as the victim to takeover their account. This issue has been patched in version 2026.3.0.

References (2)

Scores

CVSS v3 9.6
EPSS 0.0001
EPSS Percentile 3.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-601
Status published
Products (1)
hoppscotch/hoppscotch < 2026.3.0 (2 CPE variants)
Published Apr 02, 2026
Tracked Since Apr 03, 2026