Hoppscotch Open Redirect Vulnerability Leading to Token Exfiltration and Account Takeover

An open redirect vulnerability has been identified in Hoppscotch, an open-source API development ecosystem, prior to version 2026.3.0. This vulnerability allows for token exfiltration, with the potential for an attacker to use these tokens to sign in as the victim and take over their account.

Impact

Exploitation of this vulnerability allows for account takeover by exfiltrating access and refresh tokens, which can be used to authenticate as the victim.

Reproduction

To reproduce this vulnerability, log into a self-hosted instance of Hoppscotch. Set up a listener for incoming requests, which will capture the access and refresh tokens. Then, navigate to the device-login endpoint, providing a redirect_uri that points to the listener. After clicking 'Proceed', the listener will receive the tokens, demonstrating the successful exploitation of the open redirect.

Remediation

Users can update to Hoppscotch version 2026.3.0, which patches the open redirect vulnerability and the associated token theft.