CVE-2026-50160 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-50160CRITICAL

hoppscotch hoppscotch — Mass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET Overwrite

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  H  H  N   10.0   .1775   96.9     —

AFFECTED
  Product     Versions       Fixed
  hoppscotch  <= 2026.4.1 –  —

TIMELINE
  Jun 3   Reserved by GitHub_M
  Jul 1   EXPLOIT PUBLISHED — CVE-2026-50160 (hoppscotch). Public exploit reference added.
  Jul 1   Published (CNA: GitHub_M)

CWE-915 · CNA: GitHub_M · CVSS v3.1 · 3 references · NVD status: Analyzed

Description

Hoppscotch is an API development ecosystem. In self-hosted deployments of hoppscotch-backend from version 2026.4.1 and earlier, the unauthenticated POST /v1/onboarding/config endpoint is vulnerable to mass assignment. The global NestJS ValidationPipe is configured without whitelist: true, so extra properties on the request body that are not declared in SaveOnboardingConfigRequest are not stripped and are iterated in the service layer as if they were legitimate InfraConfig entries. Because keys such as JWT_SECRET and SESSION_SECRET are valid InfraConfigEnum values and are not explicitly rejected during validation, an unauthenticated attacker who can reach a fresh instance before onboarding completes (or when no users exist) can overwrite these values in the database. Overwriting JWT_SECRET gives the attacker control of the JWT signing key, allowing them to forge tokens for any user, including administrators, and results in full server compromise. The issue is fixed in hoppscotch 2026.5.0.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
June 3, 2026	Reserved	Reserved by GitHub_M
July 1, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-50160 (hoppscotch). Public exploit reference added.
July 1, 2026	Published	Published (CNA: GitHub_M)

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
hoppscotch	hoppscotch	—	<= 2026.4.1	—

Weaknesses

CWE-915

References (3)

http://www.openwall.com/lists/oss-security/2026/06/23/7 [Exploit, Mailing List, Third Party Advisory]
https://github.com/hoppscotch/hoppscotch/pull/6171 [Issue Tracking, Patch]
https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-j542-4rch-8hwf [Exploit, Mitigation, Vendor Advisory]

Authoritative record: CVE-2026-50160 at cve.org

Vendors: hoppscotch

Weaknesses: CWE-915

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-50160 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.