CVE-2026-44478

🗓️ 13 May 2026 21:47:01Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 9 Views🌐 WEB

Hoppscotch fixes secret leakage via GET /v1/onboarding/config when onboarding recovery token is empty; fixed in 2026.4.0.

Reporter	Title	Published	Views	Family All 9
ATTACKERKB	CVE-2026-44478	13 May 202621:47	–	attackerkb
Circl	CVE-2026-44478	14 May 202604:41	–	circl
CNNVD	Hoppscotch 访问控制错误漏洞	13 May 202600:00	–	cnnvd
Cvelist	CVE-2026-44478 hoppscotch: Unauthenticated Onboarding Config Disclosure via Empty Recovery Token	13 May 202621:47	–	cvelist
EUVD	EUVD-2026-30201	13 May 202621:47	–	euvd
NVD	CVE-2026-44478	13 May 202622:16	–	nvd
Positive Technologies	PT-2026-40829	13 May 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-44478	15 May 202619:57	–	redhatcve
Vulnrichment	CVE-2026-44478 hoppscotch: Unauthenticated Onboarding Config Disclosure via Empty Recovery Token	13 May 202621:47	–	vulnrichment

Vulners

Node

hoppscotch hoppscotchRange2025.7.0–2026.4.0

[
  {
    "vendor": "hoppscotch",
    "product": "hoppscotch",
    "versions": [
      {
        "version": ">= 2025.7.0, < 2026.4.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/hoppscotch/hoppscotch/security/advisories/GHSA-7c8p-hj4p-3q3f

Parameter	Position	Path	Description	CWE
config	request body	/v1/onboarding/config	Unauthenticated POST to /v1/onboarding/config allows config overwrites due to missing onboarding state checks.	CWE-287, CWE-284
onboardingConfig	request body	/v1/onboarding/config	Unauthenticated POST to /v1/onboarding/config allows config overwrites due to missing onboarding state checks.	CWE-287, CWE-284

15 May 2026 19:17Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.5

EPSS0.00058

SSVC