Skip to content
Fencer Vulns
critical 10.0

CVE-2026-50160 json

Mass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET Overwrite

published 2026-07-01 4 mo ago modified 2026-07-02 4 mo ago also EUVD-2026-41107

cvss
10.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.7%
EPSS 1.7% chance of exploitation in 30 days, percentile 77%
public exploits
0
none known, plus a Nuclei check

Summary

Hoppscotch is an API development ecosystem. In self-hosted deployments of hoppscotch-backend from version 2026.4.1 and earlier, the unauthenticated POST /v1/onboarding/config endpoint is vulnerable to mass assignment. The global NestJS ValidationPipe is configured without whitelist: true, so extra properties on the request body that are not declared in SaveOnboardingConfigRequest are not stripped and are iterated in the service layer as if they were legitimate InfraConfig entries. Because keys such as JWT_SECRET and SESSION_SECRET are valid InfraConfigEnum values and are not explicitly rejected during validation, an unauthenticated attacker who can reach a fresh instance before onboarding completes (or when no users exist) can overwrite these values in the database. Overwriting JWT_SECRET gives the attacker control of the JWT signing key, allowing them to forge tokens for any user, including administrators, and results in full server compromise. The issue is fixed in hoppscotch 2026.5.0.

Patch / fix

  • hoppscotch hoppscotch 2026.5.0

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
total
Assessed
4 mo ago

Exploit prediction

1.70% chance of exploitation in the next 30 days, higher than 77% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Nuclei template Hoppscotch <= 2026.4.1 - Mass Assignment JWT_SECRET Overwrite nuclei detection template
  • github.com https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-j542-4rch-8hwf referenced PoC, tagged "exploit" by a source, unverified
  • openwall.com http://www.openwall.com/lists/oss-security/2026/06/23/7 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Affected products

  • hoppscotch hoppscotch

Classification

Weakness
  • CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.