CVE-2026-28215 - Vulnerability Analysis

Overview

Hoppscotch prior to 2026.2.0 contains an authentication bypass caused by lack of authentication on POST /v1/onboarding/config, letting unauthenticated attackers overwrite infrastructure configuration and capture OAuth tokens, exploit requires no authentication.

Severity & Score

Impact

Unauthenticated attackers can hijack OAuth credentials, capture user tokens and emails, and access all stored secrets, compromising user data and system integrity.

Mitigation

Update to version 2026.2.0 or later.

References

• https://github.com/hoppscotch/hoppscotch/releases/tag/2026.2.0
• https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-jwv8-867r-q9fg

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner