CVE-2026-50160 Mass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET Overwrite
Unauthenticated attackers can overwrite JWT secrets via mass assignment in self-hosted Hoppscotch, enabling token forgery and full server compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-50160?
CVE-2026-50160 is a critical missing authorization vulnerability in hoppscotch, published on 1 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Hoppscotch is an API development ecosystem. In self-hosted deployments of hoppscotch-backend from version 2026.4.1 and earlier, the unauthenticated POST /v1/onboarding/config endpoint is vulnerable to mass assignment. The global NestJS ValidationPipe is configured without whitelist: true, so extra properties on the request body that are not declared in SaveOnboardingConfigRequest are not stripped and are iterated in the service layer as if they were legitimate InfraConfig entries. Because keys such as JWT_SECRET and SESSION_SECRET are valid InfraConfigEnum values and are not explicitly rejected during validation, an unauthenticated attacker who can reach a fresh instance before onboarding completes (or when no users exist) can overwrite these values in the database. Overwriting JWT_SECRET gives the attacker control of the JWT signing key, allowing them to forge tokens for any user, including administrators, and results in full server compromise. The issue is fixed in hoppscotch 2026.5.0.
Weakness: CWE-915
Which versions are affected by CVE-2026-50160?
It affects 1 product.
Products include Hoppscotch Hoppscotch.
How do I fix CVE-2026-50160?
No fix has been published for CVE-2026-50160 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-50160 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-50160 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in hoppscotch
- CVE-2026-28215 hoppscotch Vulnerable to Unauthenticated Onboarding Config Takeover
- CVE-2026-34931 hoppscotch: Improper loopback redirect_uri validation in device-login flow
- CVE-2026-34932 hoppscotch: Stored XSS via mock server responses on backend origin
- CVE-2026-28216 hoppscotch has IDOR in updateUserEnvironment / deleteUserEnvironment
- CVE-2022-0121 Cross-site Scripting in hoppscotch/hoppscotch
Sources
Also known as GHSA-j542-4rch-8hwf.