This vulnerability arises from improper validation of loopback redirect_uri parameters during the device-login flow in Hoppscotch, an open source API development platform. Because the redirect_uri is not checked against allowed values, an attacker can supply a malicious URL and receive the authentication token intended for the legitimate user. Possession of this token allows the attacker to sign in as the victim, effectively taking over their account. The weakness is classified as an open redirect leading to token theft and subsequent unauthorized access.

The affected product is the Hoppscotch API development ecosystem, specifically all releases before version 2026.3.0. Anyone using the device-login flow in these outdated releases is susceptible to this issue.

The vulnerability carries a CVSS score of 8.5, indicating high severity. Although no EPSS score is available and the issue is not listed in the CISA KEV catalog, the attack can be carried out remotely by exploiting the unchecked redirect_uri. An attacker only needs to construct a malicious redirect URL and have a user run the device-login flow to capture the token. This straightforward exploitation path, combined with the high potential impact of account takeover, makes the risk significant.