CVE-2026-50160: Hoppscotch Auth Bypass Vulnerability

CVE-2026-50160 Overview

CVE-2026-50160 is a mass assignment vulnerability in Hoppscotch, an open-source API development ecosystem. The flaw affects self-hosted deployments of hoppscotch-backend version 2026.4.1 and earlier. The unauthenticated POST /v1/onboarding/config endpoint accepts arbitrary properties because the global NestJS ValidationPipe is configured without whitelist: true. An unauthenticated attacker who reaches a fresh instance before onboarding completes can overwrite sensitive InfraConfig entries including JWT_SECRET and SESSION_SECRET. This vulnerability is classified under [CWE-915] (Improperly Controlled Modification of Dynamically-Determined Object Attributes).

Critical Impact
Overwriting JWT_SECRET allows attackers to forge authentication tokens for any user, including administrators, resulting in full server compromise.

Affected Products

Hoppscotch self-hosted backend version 2026.4.1 and earlier
hoppscotch-backend deployments prior to onboarding completion
Fresh Hoppscotch instances with no existing users

Discovery Timeline

2026-07-01 - CVE-2026-50160 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-50160

Vulnerability Analysis

The vulnerability resides in the onboarding configuration endpoint of hoppscotch-backend. The endpoint POST /v1/onboarding/config accepts a request body validated against the SaveOnboardingConfigRequest data transfer object. However, the global NestJS ValidationPipe lacks the whitelist: true setting, so extra properties on the request body are not stripped before reaching the service layer.

The service layer iterates over all provided properties as if they were legitimate InfraConfig entries. Since JWT_SECRET and SESSION_SECRET are valid InfraConfigEnum values, these entries are written directly to the database without explicit rejection. The endpoint is reachable without authentication when no users exist or when onboarding has not completed.

Root Cause

The root cause is a missing whitelist: true configuration in the NestJS validation layer combined with insufficient allowlisting of writable configuration keys. The service treats any InfraConfigEnum-valid key as a legitimate onboarding field. There is no explicit deny list for sensitive secrets such as JWT signing keys or session secrets during onboarding.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP POST request to /v1/onboarding/config on a fresh Hoppscotch instance. The request body includes extra properties beyond the expected onboarding fields, such as JWT_SECRET set to an attacker-controlled value. The backend persists these values into the InfraConfig store. The attacker then signs a JWT with the known secret, impersonates any user including administrators, and gains full control of the server.

Further technical details are available in the GitHub Security Advisory GHSA-j542-4rch-8hwf and the Hoppscotch Pull Request #6171.

Detection Methods for CVE-2026-50160

Indicators of Compromise

HTTP POST requests to /v1/onboarding/config containing fields outside the expected SaveOnboardingConfigRequest schema, particularly JWT_SECRET or SESSION_SECRET.
Unexpected modifications to InfraConfig database records for keys JWT_SECRET or SESSION_SECRET on instances where onboarding was already completed or should have been restricted.
Successful authentication events for administrator accounts without corresponding legitimate login flows.

Detection Strategies

Inspect reverse proxy and application logs for unauthenticated requests to /v1/onboarding/config with anomalously large or unexpected JSON payloads.
Compare current values of JWT_SECRET and SESSION_SECRET in the database against known-good baselines captured at deployment.
Alert on JWTs presented to the backend that decode to administrator identities but lack matching session provisioning events.

Monitoring Recommendations

Enable audit logging on the InfraConfig table and forward events to a centralized log platform for review.
Monitor network traffic to the Hoppscotch backend for POST requests to onboarding endpoints from untrusted networks.
Track HTTP 200 responses from /v1/onboarding/config after initial deployment as they should be rare or nonexistent.

How to Mitigate CVE-2026-50160

Immediate Actions Required

Upgrade hoppscotch-backend to version 2026.5.0 or later, which addresses the mass assignment flaw.
Rotate JWT_SECRET and SESSION_SECRET values after upgrading and invalidate all existing sessions and tokens.
Restrict network access to the Hoppscotch backend so that only trusted networks can reach onboarding endpoints during initial deployment.
Audit the InfraConfig table for unauthorized modifications made prior to patching.

Patch Information

The issue is fixed in Hoppscotch 2026.5.0. The remediation is described in Hoppscotch Pull Request #6171 and the GitHub Security Advisory GHSA-j542-4rch-8hwf. Additional discussion is available on the Openwall oss-security mailing list.

Workarounds

Place the Hoppscotch backend behind an authenticated reverse proxy or VPN until the upgrade is applied.
Complete onboarding immediately after deployment to reduce the window in which the unauthenticated endpoint is reachable.
Add a network-level access control rule that blocks external requests to /v1/onboarding/config.

bash

# Example nginx rule to block external access to the onboarding endpoint
location /v1/onboarding/config {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://hoppscotch-backend;
}