Critical Hoppscotch Vulnerability (CVE-2026-50160) Enables Full System Takeover A severe security flaw (CVE-2026-50160) has been discovered in the self-hosted Hoppscotch backend, allowing unauthenticated attackers to overwrite sensitive configuration values including the JWT signing secret and gain full administrative control of affected instances. The vulnerability, detailed in GitHub advisory GHSA-j542-4rch-8hwf, impacts all versions up to 2026.4.1 and has been patched in 2026.5.0. With a CVSS score of 10.0, the flaw is trivial to exploit and poses a catastrophic risk. ### Root Cause & Exploitation The vulnerability stems from a mass assignment flaw in the POST /v1/onboarding/config endpoint, which is accessible without authentication during the initial setup phase (when no users exist). The endpoint, designed to configure onboarding parameters like SMTP and OAuth settings, lacks proper input validation, allowing attackers to inject arbitrary configuration keys. The issue arises from the misuse of NestJS ValidationPipe without the `allowlist` option enabled, permitting unfiltered request data to bypass validation. Sensitive keys like JWT_SECRET and SESSION_SECRET valid internal enum values can be overwritten, as the `validateEnvValues` logic fails to reject unauthorized entries. ### Attack Chain & Impact A successful exploit requires just a single crafted HTTP request. Attackers can: - Overwrite JWT_SECRET, enabling token forgery for any user (including admins). - Bypass JwtAuthGuard protections, granting unrestricted access to sensitive data and API keys. - Hijack sessions by modifying SESSION_SECRET, invalidating legitimate user sessions. - Maintain persistent access even after credential resets. The flaw is particularly dangerous for newly deployed instances exposed to the internet before onboarding is complete, creating a high-risk window for automated or opportunistic attacks. ### Proof-of-Concept Exploitation A basic exploit involves: 1. Checking onboarding status via `GET /v1/onboarding/status`. 2. Sending a malicious POST request to overwrite secrets: ```json { "JWT_SECRET": "ATTACKER_CONTROLLED_VALUE", "SESSION_SECRET": "ATTACKER_CONTROLLED_VALUE" } ``` 3. Verifying compromise by querying the database for stored secrets. ### Mitigation & Remediation The advisory recommends: - Immediate upgrade to Hoppscotch 2026.5.0 or later. - Enabling `whitelist: true` in ValidationPipe to strip unknown fields. - Strict allowlisting of configuration keys and explicit validation for sensitive parameters. - Enforcing authentication or one-time setup tokens for onboarding endpoints. The vulnerability is classified under CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes), a common but critical flaw in modern API frameworks. Unpatched instances remain critically vulnerable to remote compromise with no user interaction required.