CVE-2026-50160

The global NestJS validation mechanism (ValidationPipe) is configured without the whitelist: true option, so additional properties sent in the request body are not removed before processing. Keys such as JWT_SECRET and SESSION_SECRET are valid InfraConfigEnum values and are not explicitly rejected during validation, so they reach the service layer as legitimate configuration entries. An unauthenticated attacker can send a request to the onboarding endpoint (accessible before configuration completion or when no user exists) and overwrite these values directly in the database. After compromising JWT_SECRET, the attacker gains full control over the JWT token signing process and can issue valid tokens for any account.

An attacker can forge JWT tokens for any user, including administrators, resulting in complete server takeover and unauthorized access to all application data and functions.

Update Hoppscotch to version 2026.5.0, in which the issue has been fixed. As an interim security measure, restrict network access to the POST /v1/onboarding/config endpoint and ensure that the onboarding process has been completed (at least one user exists in the system).

Self-hosted hoppscotch-backend deployments in version 2026.4.1 and earlier, accessible before completing the onboarding process or when no user exists in the system.