This vulnerability underlies an Improper Access Control flaw (CWE-284) and an Authentication Bypass (CWE-287). An unauthenticated attacker can read the entire set of infrastructure secrets when the GET /v1/onboarding/config endpoint is invoked and the ONBOARDING_RECOVERY_TOKEN database entry is an empty string. The secrets are returned in plain text, allowing straightforward exfiltration of credentials, access keys, and other configuration that could compromise both the application and its underlying infrastructure.

hoppscotch, the open‑source API development environment, is affected by this flaw in all versions prior to 2026.4.0. The issue is triggered when the onboarding recovery token stored in the database is an empty string, a scenario that can arise during initial setup or configuration resets.

The CVSS score of 7.5 indicates a high risk level, and the EPSS score is not reported, but the lack of authentication on the affected endpoint simplifies exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet, but the straightforward attack path and potential for credential leakage warrant immediate attention. Attackers need only send a simple HTTP GET to the endpoint; no additional privileges or complex setup is required.