CVE-2026-28215 - Vulnerability Analysis

Overview

Hoppscotch prior to 2026.2.0 contains an authentication bypass caused by lack of authentication on POST /v1/onboarding/config, letting unauthenticated attackers overwrite infrastructure configuration and capture OAuth tokens, exploit requires no authentication.

Severity & Score

Impact

Unauthenticated attackers can hijack OAuth credentials, capture user tokens and emails, and access all stored secrets, compromising user data and system integrity.

Mitigation

Update to version 2026.2.0 or later.

References

• https://github.com/hoppscotch/hoppscotch/releases/tag/2026.2.0
• https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-jwv8-867r-q9fg

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 28, 2026

🔴 CVE-2026-28215 - Critical (9.1) hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, an unauthenticated attacker can overwrite the entire infrastructure configuration of a self-hosted Hoppscotch instance including OAuth provider credentials and SMTP... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28215/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner