CVE-2026-34931: hoppscotch: Improper loopback redirect_uri validation in device-login flow
hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, there is an open redirect vulnerability that leads to token exfiltration. With these tokens, the attacker can sign in as the victim to takeover their account. This issue has been patched in version 2026.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
hoppscotchto a version that resolves this vulnerability.Fixed in 2026.3.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34931?
CVE-2026-34931 is considered a critical severity vulnerability due to the potential for token exfiltration and unauthorized access.
How do I fix CVE-2026-34931?
To mitigate CVE-2026-34931, upgrade Hoppscotch to version 2026.3.0 or later.
What types of attacks can exploit CVE-2026-34931?
CVE-2026-34931 can be exploited through open redirect attacks leading to token theft during the device-login flow.
Who is affected by CVE-2026-34931?
Users of Hoppscotch versions prior to 2026.3.0 are affected by CVE-2026-34931.
What is the nature of the vulnerability in CVE-2026-34931?
CVE-2026-34931 involves improper loopback redirect_uri validation which allows for open redirect vulnerabilities.