CVE-2026-28215

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28215", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-25T15:28:40.649Z", "datePublished": "2026-02-26T22:34:46.524Z", "dateUpdated": "2026-03-02T20:42:36.125Z"}, "containers": {"cna": {"title": "hoppscotch Vulnerable to Unauthenticated Onboarding Config Takeover", "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-jwv8-867r-q9fg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-jwv8-867r-q9fg"}, {"name": "https://github.com/hoppscotch/hoppscotch/releases/tag/2026.2.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/hoppscotch/hoppscotch/releases/tag/2026.2.0"}], "affected": [{"vendor": "hoppscotch", "product": "hoppscotch", "versions": [{"version": "< 2026.2.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-26T22:34:46.524Z"}, "descriptions": [{"lang": "en", "value": "hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, an unauthenticated attacker can overwrite the entire infrastructure configuration of a self-hosted Hoppscotch instance including OAuth provider credentials and SMTP settings by sending a single HTTP POST request with no authentication. The endpoint POST /v1/onboarding/config has no authentication guard and performs no check on whether onboarding was already completed. A successful exploit allows the attacker to replace the instance's Google/GitHub/Microsoft OAuth application credentials with their own, causing all subsequent user logins via SSO to authenticate against the attacker's OAuth app. The attacker captures OAuth tokens and email addresses of every user who logs in after the exploit. Additionally, the endpoint returns a recovery token that can be used to read all stored secrets in plaintext, including SMTP passwords and any other configured credentials. Version 2026.2.0 fixes the issue."}], "source": {"advisory": "GHSA-jwv8-867r-q9fg", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-02T20:42:24.106797Z", "id": "CVE-2026-28215", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T20:42:36.125Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28215", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-02T20:42:24.106797Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T20:42:32.791Z"}}], "cna": {"title": "hoppscotch Vulnerable to Unauthenticated Onboarding Config Takeover", "source": {"advisory": "GHSA-jwv8-867r-q9fg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "hoppscotch", "product": "hoppscotch", "versions": [{"status": "affected", "version": "< 2026.2.0"}]}], "references": [{"url": "https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-jwv8-867r-q9fg", "name": "https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-jwv8-867r-q9fg", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/hoppscotch/hoppscotch/releases/tag/2026.2.0", "name": "https://github.com/hoppscotch/hoppscotch/releases/tag/2026.2.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, an unauthenticated attacker can overwrite the entire infrastructure configuration of a self-hosted Hoppscotch instance including OAuth provider credentials and SMTP settings by sending a single HTTP POST request with no authentication. The endpoint POST /v1/onboarding/config has no authentication guard and performs no check on whether onboarding was already completed. A successful exploit allows the attacker to replace the instance's Google/GitHub/Microsoft OAuth application credentials with their own, causing all subsequent user logins via SSO to authenticate against the attacker's OAuth app. The attacker captures OAuth tokens and email addresses of every user who logs in after the exploit. Additionally, the endpoint returns a recovery token that can be used to read all stored secrets in plaintext, including SMTP passwords and any other configured credentials. Version 2026.2.0 fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-26T22:34:46.524Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28215", "state": "PUBLISHED", "dateUpdated": "2026-03-02T20:42:36.125Z", "dateReserved": "2026-02-25T15:28:40.649Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-26T22:34:46.524Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "hoppscotch", "vendor": "hoppscotch", "versions": [{"status": "affected", "version": "< 2026.2.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hoppscotch:hoppscotch:*:*:*:*:*:*:*:*", "matchCriteriaId": "3FF8DA47-4B0B-4592-80AD-66C7913AD164", "versionEndExcluding": "2026.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, an unauthenticated attacker can overwrite the entire infrastructure configuration of a self-hosted Hoppscotch instance including OAuth provider credentials and SMTP settings by sending a single HTTP POST request with no authentication. The endpoint POST /v1/onboarding/config has no authentication guard and performs no check on whether onboarding was already completed. A successful exploit allows the attacker to replace the instance's Google/GitHub/Microsoft OAuth application credentials with their own, causing all subsequent user logins via SSO to authenticate against the attacker's OAuth app. The attacker captures OAuth tokens and email addresses of every user who logs in after the exploit. Additionally, the endpoint returns a recovery token that can be used to read all stored secrets in plaintext, including SMTP passwords and any other configured credentials. Version 2026.2.0 fixes the issue."}, {"lang": "es", "value": "hoppscotch es un ecosistema de desarrollo de API de c\u00f3digo abierto. Antes de la versi\u00f3n 2026.2.0, un atacante no autenticado puede sobrescribir toda la configuraci\u00f3n de infraestructura de una instancia de Hoppscotch autoalojada, incluyendo las credenciales del proveedor OAuth y la configuraci\u00f3n SMTP, enviando una \u00fanica solicitud HTTP POST sin autenticaci\u00f3n. El endpoint POST /v1/onboarding/config no tiene protecci\u00f3n de autenticaci\u00f3n y no realiza ninguna comprobaci\u00f3n sobre si la incorporaci\u00f3n ya se complet\u00f3. Un exploit exitoso permite al atacante reemplazar las credenciales de la aplicaci\u00f3n OAuth de Google/GitHub/Microsoft de la instancia con las suyas propias, haciendo que todos los inicios de sesi\u00f3n de usuario posteriores a trav\u00e9s de SSO se autentiquen contra la aplicaci\u00f3n OAuth del atacante. El atacante captura tokens OAuth y direcciones de correo electr\u00f3nico de cada usuario que inicia sesi\u00f3n despu\u00e9s del exploit. Adem\u00e1s, el endpoint devuelve un token de recuperaci\u00f3n que puede usarse para leer todos los secretos almacenados en texto plano, incluyendo contrase\u00f1as SMTP y cualquier otra credencial configurada. La versi\u00f3n 2026.2.0 soluciona el problema."}], "id": "CVE-2026-28215", "lastModified": "2026-06-17T10:28:20.853", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28215", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-02T20:42:24.106797Z", "version": "2.0.3"}}]}, "published": "2026-02-26T23:16:35.940", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/hoppscotch/hoppscotch/releases/tag/2026.2.0"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-jwv8-867r-q9fg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-287"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2026.2.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "hoppscotch", "source": "cna", "vendor": "hoppscotch"}, "product": "hoppscotch", "vendor": "hoppscotch"}], "analysis": {"en": {"generated_at": "2026-04-16T15:57:04.645695+00:00", "value": {"mitigation_remediation": ["Update Hoppscotch to version 2026.2.0 or later", "If an upgrade cannot be performed immediately, block unauthenticated POST requests to /v1/onboarding/config using a firewall or reverse\u2011proxy rule", "After the fix or block, revoke any compromised OAuth credentials, reset stored secrets and rotate any affected SMTP passwords"], "summary": {"action": "Immediate Patch", "impact": "Authentication Bypass"}, "threat_synthesis": {"affected_systems": "Hoppscotch self\u2011hosted instances of the open\u2011source API development ecosystem. All releases older than 2026.2.0 are vulnerable. The affected product is listed as hoppscotch from the hoppscotch vendor, and the fix is included in the 2026.2.0 release and later.", "description_and_impact": "An unauthenticated attacker can send a single POST request to /v1/onboarding/config on a self\u2011hosted Hoppscotch instance without any authentication. The endpoint performs no guard checks when the onboarding process has already been completed, so the request completely overwrites the infrastructure configuration. This allows the attacker to replace OAuth provider credentials for Google, GitHub and Microsoft with credentials under the attacker\u2019s control, causing all future single\u2011sign\u2011on logins to authenticate against the attacker\u2019s OAuth application. The attacker also obtains OAuth tokens and email addresses of any user who logs in after the takeover. In addition, the response returns a recovery token that can be used to read all stored secrets such as SMTP passwords in plaintext.", "risk_and_exploitability": "The vulnerability has a CVSS score of 9.1, indicating critical severity. The EPSS score is less than 1%, suggesting that exploitation probability, while low, is not negligible and an attack can be performed easily over the network without requiring any credentials. The issue is not listed in the CISA KEV catalog, but the combination of high impact and easy exploitation makes it highly likely to be targeted. The only requirement for exploitation is the ability to send an unauthenticated HTTP POST to the server, which is trivially achieved from any machine that can reach the instance."}}}}, "created": "2026-02-27T09:03:52.205126+00:00", "updated": "2026-04-16T16:00:13.885641+00:00", "vendors": ["hoppscotch", "hoppscotch$PRODUCT$hoppscotch"]}