Nixpkgs security tracker

Untriaged

Permalink CVE-2026-34931

created 2 weeks, 1 day ago

hoppscotch: Improper loopback redirect_uri validation in device-login flow

hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, there is an open redirect vulnerability that leads to token exfiltration. With these tokens, the attacker can sign in as the victim to takeover their account. This issue has been patched in version 2026.3.0.

References

https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-7fg7-wx5q-6m3v x_refsource_CONFIRM
https://github.com/hoppscotch/hoppscotch/releases/tag/2026.3.0 x_refsource_MISC

Affected products

hoppscotch

==< 2026.3.0

Matching in nixpkgs

pkgs.hoppscotch

Open source API development ecosystem

nixos-unstable 26.2.1-0
- nixpkgs-unstable 26.2.1-0
- nixos-unstable-small 26.2.1-0
nixos-25.11 25.9.1-0
- nixos-25.11-small 25.9.1-0
- nixpkgs-25.11-darwin 25.9.1-0

Package maintainers

@DataHearth DataHearth <dev@antoine-langlois.net>

Suggestion detail

References

Affected products

Matching in nixpkgs

pkgs.hoppscotch

Package maintainers