API Development Ecosystem Vulnerability in Hoppscotch

CVE-2026-28215

What is CVE-2026-28215?

Hoppscotch, an open source API development ecosystem, is vulnerable due to a lack of authentication on the configuration onboarding endpoint. Attackers can exploit this by sending a single HTTP POST request to overwrite critical infrastructure settings, including OAuth provider credentials and SMTP configurations, without any form of authentication. This vulnerability not only enables the attacker to replace the OAuth application credentials for services like Google, GitHub, and Microsoft but also allows them to capture OAuth tokens and user emails. Furthermore, the endpoint’s response includes a recovery token, granting access to all stored secrets in plaintext. The issue has been rectified in version 2026.2.0.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References