An unauthenticated attacker can send a single POST request to /v1/onboarding/config on a self‑hosted Hoppscotch instance without any authentication. The endpoint performs no guard checks when the onboarding process has already been completed, so the request completely overwrites the infrastructure configuration. This allows the attacker to replace OAuth provider credentials for Google, GitHub and Microsoft with credentials under the attacker’s control, causing all future single‑sign‑on logins to authenticate against the attacker’s OAuth application. The attacker also obtains OAuth tokens and email addresses of any user who logs in after the takeover. In addition, the response returns a recovery token that can be used to read all stored secrets such as SMTP passwords in plaintext.

Hoppscotch self‑hosted instances of the open‑source API development ecosystem. All releases older than 2026.2.0 are vulnerable. The affected product is listed as hoppscotch from the hoppscotch vendor, and the fix is included in the 2026.2.0 release and later.

The vulnerability has a CVSS score of 9.1, indicating critical severity. The EPSS score is less than 1%, suggesting that exploitation probability, while low, is not negligible and an attack can be performed easily over the network without requiring any credentials. The issue is not listed in the CISA KEV catalog, but the combination of high impact and easy exploitation makes it highly likely to be targeted. The only requirement for exploitation is the ability to send an unauthenticated HTTP POST to the server, which is trivially achieved from any machine that can reach the instance.