What is the CVSS score of CVE-2026-50160?

CVE-2026-50160 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.6%.

Is there a public PoC exploit available for CVE-2026-50160?

Yes, a public proof-of-concept exploit is available for CVE-2026-50160. Prioritise patching immediately. EPSS: 0.6%.

Hoppscotch CVE-2026-50160

EUVD-2026-41107 CRITICAL

Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915)

2026-06-23

Information Disclosure Hoppscotch

10.0

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

10.0 CRITICAL

Network-accessible unauthenticated endpoint (AV:N, PR:N, AC:L, UI:N); JWT secret takeover enables forged tokens for all users, constituting a scope change with full CIA impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

CVSS changed

Jul 01, 2026 - 19:22 NVD

10.0 (CRITICAL)

Analysis Generated

Jun 23, 2026 - 20:19 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Unauthenticated mass assignment in Hoppscotch self-hosted exposes the JWT_SECRET and SESSION_SECRET to full attacker control via a single HTTP POST request to the onboarding endpoint, enabling forged authentication tokens for any user including administrators. All self-hosted deployments running version 2026.4.1 and earlier are affected during the initial onboarding window or when re-onboarding is enabled. A working proof of concept is publicly available and the attack is fully automatable with no credentials, no user interaction, and no special tooling required.

Technical ContextAI

Hoppscotch is a NestJS-based open-source API development and testing platform with over 79,000 GitHub stars, commonly self-hosted by development and security teams. The vulnerability is a compound mass assignment flaw (CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes) combined with a missing authentication control (CWE-306) on a sensitive configuration endpoint. Four distinct weaknesses chain together: (1) NestJS ValidationPipe is configured without whitelist:true, so extra properties in the JSON request body are not stripped before processing; (2) Object.entries(dto) iterates all submitted properties without runtime key validation or allowlisting; (3) the validateEnvValues function uses a default:break pattern, causing sensitive keys like JWT_SECRET to silently pass validation without triggering an error; and (4) the POST /v1/onboarding/config endpoint on port 3170 requires no authentication. The combined effect allows arbitrary InfraConfig keys - including the JWT signing secret and session secret - to be written directly into the application database (stored AES-256-CBC encrypted but under attacker control), overwriting the legitimate secrets.

RemediationAI

Upgrade to Hoppscotch self-hosted version 2026.5.0 immediately, as confirmed by the GitHub Security Advisory GHSA-j542-4rch-8hwf (https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-j542-4rch-8hwf) and the full researcher writeup at https://www.offgridsec.com/blog-hoppscotch-cve-2026-50160.html. If immediate upgrade is not possible, apply the following compensating controls in order of priority: block all external network access to port 3170 until onboarding is complete, which eliminates the unauthenticated attack surface at the cost of requiring onboarding from a trusted network only; complete the onboarding flow immediately upon deployment before the instance is internet-exposed, closing the attack window; and disable re-onboarding mode if it is not actively required. After patching or completing onboarding, rotate JWT_SECRET and SESSION_SECRET and invalidate all active sessions, as any instance previously exposed during onboarding must be treated as fully compromised with all stored credentials and tokens considered attacker-known.