A DOM‑based open redirect was discovered on the /enter route of hoppscotch. The page uses the redirect query string value directly to set the location header without validation. An attacker can supply any URL, causing the victim’s browser to navigate to a malicious site. The vulnerability falls under CWE‑601. While it does not grant code execution or direct data exposure, it enables phishing, delivery of malware, and other social engineering attacks. The CVSS score of 4.7 indicates a moderate risk to users.

The issue affects hoppscotch, the open‑source API development ecosystem. Any release prior to version 2026.3.0 is susceptible. The fix is implemented in version 2026.3.0 and later. Users must verify the exact version of the deployed instance and upgrade accordingly.

The vulnerability carries a CVSS score of 4.7; the EPSS metric is not available and it is not listed in the CISA KEV catalog. Exploitation requires an attacker to construct a malicious URL to the /enter endpoint, which users may click or be redirected to by another site. Thus the attack vector is mainly web‑based and user‑initiated, with a low likelihood of widespread automated exploitation without social‑engineering cues.