hoppscotch — Vulnerabilities & Security Advisories 11

All 11 CVE vulnerabilities found in hoppscotch, with AI-generated Chinese analysis, references, and POCs.

CVE ID	Title	CVSS	Severity	Published
CVE-2026-34931	hoppscotch: Improper loopback redirect_uri validation in device-login flow CWE-601	6.1^AI	Medium^AI	2026-04-02
CVE-2026-34848	hoppscotch: Stored XSS in team member overflow tooltip via display name CWE-79	5.4	Medium	2026-04-02
CVE-2026-34932	hoppscotch: Stored XSS via mock server responses on backend origin CWE-79	8.1^AI	High^AI	2026-04-02
CVE-2026-34847	hoppscotch: Open redirect via `/enter?redirect=` CWE-601	4.7	Medium	2026-04-02
CVE-2026-30825	hoppscotch: IDOR - Any authenticated user can revoke any other user's Personal Access Token CWE-639	-	-	2026-03-07
CVE-2026-28217	IDOR in GraphQL userCollection Query Exposes Other Users' Private Collections CWE-862	6.5	Medium	2026-02-26
CVE-2026-28216	hoppscotch has IDOR in updateUserEnvironment / deleteUserEnvironment CWE-639	8.3	High	2026-02-26
CVE-2026-28215	hoppscotch Vulnerable to Unauthenticated Onboarding Config Takeover CWE-284	9.1	Critical	2026-02-26
CVE-2024-34347	@hoppscotch/cli affected by Sandbox Escape in @hoppscotch/js-sandbox leads to RCE CWE-77	8.4	High	2024-05-08
CVE-2024-27092	Content spoofing - real Hoppscotch emails CWE-20	5.4	Medium	2024-02-26
CVE-2023-34097	Database password exposed in logs in hoppscotch CWE-532	7.8	High	2023-06-05

All 11 known CVE vulnerabilities affecting hoppscotch with full Chinese analysis, references, and POCs where available.