CVE-2026-34931 is a critical open redirect in Hoppscotch, an open source API development tool. NVD scores it 9.6. The record says it can leak tokens that allow account takeover. Upgrade to Hoppscotch 2026.3.0 or later. Users should follow only trusted sign in links until then.
What's affected
Hoppscotch before 2026.3.0. The fixed release is 2026.3.0.
The cloud service is run by the project. Self hosted deployments need their own upgrade.
How to check if you're exposed
For a self hosted instance, read the version from the app footer or the image tag, and compare with 2026.3.0.
docker images | grep -i hoppscotch
If you use the hosted service, check the project's notices for any steps for your account.
What to do now
- Upgrade self hosted Hoppscotch to 2026.3.0 or later.
- After upgrading, sign users out and have them sign in again so older tokens are not kept.
- Warn users not to follow unexpected sign in links to your instance.
- Review any API keys or environment variables that team members store in the app, and rotate those that matter.
Why it matters
The weakness is CWE-601, URL redirection to an untrusted site. An application accepts a destination in a link and sends the user there. In a sign in flow, that can send tokens along with the visitor to a place the attacker chooses.
The record says the tokens can be used to sign in as the victim. The vector needs user interaction, since the victim must follow a crafted link, and the Scope Changed marker reflects the account level impact.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Open redirects are often dismissed as low risk because on their own they only move a visitor to another page. In an authentication flow the picture changes, since the redirect can carry sign in material along. That is why a bug class many scanners rank as minor is rated critical here. If you run Hoppscotch for a team, plan the upgrade as an account security fix and not as a routine release.
Quick check
Why is an open redirect rated critical here?
Because the record ties it to token exfiltration and account takeover, not only to a harmless bounce to another site.
Sources
Last reviewed: 19 October 2026.
