Which versions of Open Redirect are affected by EUVD-2026-18538?

Hoppscotch API development platform versions prior to 2026.3.0 contain a critical open redirect vulnerability that enables attackers to steal authentication tokens and compromise user accounts…. A patch is available.

How to fix or mitigate EUVD-2026-18538?

Within 24 hours: Identify all Hoppscotch instances in use across your organization and document current versions. Within 7 days: Upgrade all Hoppscotch deployments to version 2026.3.0 or later; conduct user awareness training on avoiding suspicious redirect links in development tools. Within 30 days: Conduct audit of authentication token usage logs for indicators of compromise; implement additional controls such as token rotation policies and monitoring for tokens used from unexpected geographic locations.

Open Redirect EUVD-2026-18538

Q: What is the CVSS score of EUVD-2026-18538?

EUVD-2026-18538 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-34931 HIGH

URL Redirection to Untrusted Site (Open Redirect) (CWE-601)

2026-04-02 GitHub_M

Open Redirect

8.5

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.5 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:07 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.3.0

EUVD ID Assigned

Apr 02, 2026 - 20:16 euvd

EUVD-2026-18538

Analysis Generated

Apr 02, 2026 - 20:16 vuln.today

CVE Published

Apr 02, 2026 - 19:21 nvd

HIGH 8.5

DescriptionGitHub Advisory

hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, there is an open redirect vulnerability that leads to token exfiltration. With these tokens, the attacker can sign in as the victim to takeover their account. This issue has been patched in version 2026.3.0.

AnalysisAI

Open redirect in Hoppscotch API development platform prior to version 2026.3.0 enables token exfiltration leading to complete account takeover. Attackers can craft malicious URLs that redirect authenticated users to attacker-controlled domains, stealing authentication tokens in transit. The vulnerability requires no authentication and minimal attack complexity (CVSS:4.0 AV:N/AC:L/PR:N), though user interaction is required (UI:A). No public exploit code or active exploitation confirmed at time of analysis, though the attack pattern is well-understood for CWE-601 vulnerabilities.

Technical ContextAI

This is a CWE-601 URL Redirection to Untrusted Site vulnerability affecting Hoppscotch, an open-source API development ecosystem similar to Postman. The flaw exists in the application's redirect handling logic, likely within authentication flows or OAuth callback mechanisms where tokens are passed as URL parameters or fragments. When redirect destinations are not properly validated against an allowlist, attackers can inject malicious URLs that appear legitimate but redirect to attacker-controlled domains. During this redirect, authentication tokens (likely JWT or OAuth tokens used for session management) are exposed in the URL and transmitted to the attacker's server. This affects cpe:2.3:a:hoppscotch:hoppscotch for all versions prior to 2026.3.0, representing a design flaw in URL validation routines that handle post-authentication redirects.

RemediationAI

Upgrade immediately to Hoppscotch version 2026.3.0 or later, which contains patches addressing the open redirect vulnerability. The fixed release is available at https://github.com/hoppscotch/hoppscotch/releases/tag/2026.3.0 with release notes documenting security improvements. Organizations should prioritize this upgrade for internet-facing instances and environments where users authenticate with privileged accounts. As an interim mitigation if immediate patching is not feasible, implement Web Application Firewall rules to detect and block suspicious redirect parameters, enforce strict Content Security Policy headers to limit redirect destinations, and educate users about phishing risks involving unexpected redirects after authentication. Review authentication logs for anomalous token usage patterns that might indicate historical exploitation. After upgrading, consider implementing additional security controls such as token rotation, short-lived session tokens, and monitoring for authentication anomalies.

More in Open Redirect

View all

CVE-2017-1000117 HIGH Act Now POC

8.8 Oct 05

A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca

CVE-2024-52875 HIGH Act Now POC

8.8 Jan 31

GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of

CVE-2016-5385 HIGH Act Now POC

8.1 Jul 19

PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect

CVE-2013-2248 MEDIUM This Month POC

5.8 Jul 20

Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to

CVE-2012-6499 MEDIUM This Month POC

5.8 Jan 12

Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows

CVE-2015-2863 MEDIUM This Month POC

4.3 Jul 20

Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b

CVE-2017-3528 MEDIUM This Month POC

5.4 Apr 24

Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li

CVE-2012-0518 MEDIUM Act Now

4.7 Oct 16

Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3

CVE-2024-21641 MEDIUM This Month POC

6.5 Jan 05

Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp

CVE-2015-5354 MEDIUM This Month POC

5.8 Jul 01

Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites

CVE-2015-5461 MEDIUM This Month POC

6.4 Jul 08

Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for

CVE-2024-22891 CRITICAL Act Now POC

9.8 Mar 01

Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit

Same weakness CWE-601 – URL Redirection to Untrusted Site (Open Redirect)

View all

CVE-2017-1000117 HIGH POC

8.8

CVE-2016-5385 HIGH POC

8.1

CVE-2017-3528 MEDIUM POC

5.4

CVE-2012-0518 MEDIUM

4.7

CVE-2024-21641 MEDIUM POC

6.5

CVE-2015-5354 MEDIUM POC

5.8

CVE-2024-22891 CRITICAL POC

9.8

CVE-2022-40083 CRITICAL POC

9.6

EUVD-2026-18538 vulnerability details – vuln.today

Back