CVE-2026-28215: Hoppscotch Auth Bypass Vulnerability

CVE-2026-28215 Overview

CVE-2026-28215 is a critical authentication bypass vulnerability affecting self-hosted Hoppscotch instances, an open source API development ecosystem. The vulnerability allows an unauthenticated attacker to completely overwrite the infrastructure configuration of a Hoppscotch instance, including OAuth provider credentials and SMTP settings, by sending a single HTTP POST request without any authentication.

The vulnerable endpoint POST /v1/onboarding/config lacks an authentication guard and performs no validation to check whether onboarding was already completed. This allows attackers to repeatedly exploit this endpoint on production instances that have already been configured.

Critical Impact

An unauthenticated attacker can hijack all user authentication by replacing OAuth credentials with attacker-controlled applications, capture OAuth tokens and email addresses of all users who subsequently log in, and obtain a recovery token that exposes all stored secrets including SMTP passwords in plaintext.

Affected Products

• Hoppscotch self-hosted instances prior to version 2026.2.0
• Any deployment using OAuth SSO (Google, GitHub, Microsoft) authentication
• Instances with SMTP or other credential configurations

Discovery Timeline

• 2026-02-26 - CVE CVE-2026-28215 published to NVD
• 2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-28215

Vulnerability Analysis

This vulnerability is classified as CWE-284 (Improper Access Control) and represents a severe authorization bypass in the Hoppscotch onboarding workflow. The attack can be executed remotely over the network with no user interaction required and no prior authentication needed.

A successful exploit leads to complete compromise of confidentiality and integrity for the affected instance. Attackers can capture credentials of all users who authenticate after the attack, access all stored secrets, and potentially pivot to connected services using the captured SMTP and OAuth credentials.

Root Cause

The root cause of this vulnerability is the complete absence of authentication controls on the /v1/onboarding/config endpoint. The endpoint was designed for initial instance setup but fails to implement two critical security checks:

1. Missing authentication guard - The endpoint accepts requests from any source without requiring authentication tokens or session validation
2. Missing state validation - The endpoint does not verify whether the onboarding process was already completed, allowing configurations to be overwritten at any time

Attack Vector

The attack vector is network-based and requires only HTTP access to the vulnerable Hoppscotch instance. An attacker can exploit this vulnerability through the following steps:

1. Discovery - Identify a self-hosted Hoppscotch instance accessible over the network
2. Exploitation - Send a crafted POST request to /v1/onboarding/config containing attacker-controlled OAuth application credentials
3. Credential Harvesting - Wait for users to authenticate via SSO, capturing their OAuth tokens and email addresses through the attacker's OAuth application
4. Secret Extraction - Use the recovery token returned from the exploit to read all stored secrets in plaintext

The vulnerability requires no special privileges, no user interaction, and can be exploited with a single HTTP request. The endpoint returns a recovery token that provides direct access to sensitive configuration data including SMTP passwords.

Detection Methods for CVE-2026-28215

Indicators of Compromise

• Unexpected HTTP POST requests to /v1/onboarding/config endpoint in access logs
• Changes to OAuth provider configurations (Google, GitHub, Microsoft client IDs/secrets)
• Modified SMTP settings or email configuration
• Unfamiliar recovery token generation events in application logs
• User reports of OAuth authentication redirecting to unexpected domains

Detection Strategies

• Monitor web server access logs for POST requests to /v1/onboarding/config from external IP addresses
• Implement alerting on configuration changes to OAuth provider settings
• Review authentication logs for users authenticating against unexpected OAuth application IDs
• Deploy web application firewall rules to detect and block unauthorized configuration endpoint access

Monitoring Recommendations

• Configure real-time alerts for any access to the onboarding configuration endpoint on production instances
• Establish baseline OAuth application credentials and monitor for unauthorized modifications
• Implement integrity monitoring for configuration files and database entries containing OAuth credentials
• Enable verbose logging for authentication-related events to track potential credential theft

How to Mitigate CVE-2026-28215

Immediate Actions Required

• Upgrade all self-hosted Hoppscotch instances to version 2026.2.0 or later immediately
• Review OAuth provider configurations to ensure they have not been tampered with
• Rotate all OAuth application credentials (Google, GitHub, Microsoft) as a precaution
• Change SMTP passwords and any other credentials stored in the instance configuration
• Review authentication logs for signs of unauthorized OAuth application usage

Patch Information

The vulnerability is fixed in Hoppscotch version 2026.2.0. The patch implements proper authentication guards on the onboarding endpoint and adds validation to prevent configuration overwrites after initial setup is complete.

For detailed patch information, see the GitHub Release 2026.2.0 and the GitHub Security Advisory GHSA-jwv8-867r-q9fg.

Workarounds

• Restrict network access to the Hoppscotch instance using firewall rules to trusted IP ranges only
• Implement a reverse proxy with authentication requirements for administrative endpoints
• Block access to /v1/onboarding/config at the web server or load balancer level using URL-based access controls
• Monitor and alert on any POST requests to the vulnerable endpoint until patching is complete

# Example nginx configuration to block vulnerable endpoint
location /v1/onboarding/config {
    deny all;
    return 403;
}