Hoppscotch-backend Mass Assignment on Onboarding Endpoint Allows Unauthenticated JWT_SECRET Overwrite (CVE-2026-XXXX)

Vulnerability Overview Vulnerability Name: Mass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET Overwrite Vulnerability Description: Via the endpoint, unauthenticated attackers can inject arbitrary keys (including and ) into the database. These keys are not declared in the DTO, but because NestJS does not strip extra properties, they are passed to the service layer, causing to iterate unrestrictedly over all keys. Attackers can control the JWT signing key and forge tokens for any user, including administrators. The attack is only applicable to new installations, before onboarding is completed (or when ). Impact Scope Affected Versions: <= 2026.4.1 Fixed Version: 2026.5.0 CVSS Score: 10.0 (Critical) Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: High Remediation 1. Enable in : 2. Validate allowed keys in : 3. Add explicit rejection for security-critical keys in : 4. Require authentication or a one-time setup token on the onboarding endpoint: - Protect the endpoint using a one-time setup token, following the pattern used by GitLab, Grafana, and other self-hosted tools. POC Code Step 1 - Check onboarding status (unauthenticated): Step 2 - Send mass assignment payload with extra keys: Step 3 - Verify that was overwritten: Test Results: Before Attack: in DB (AES-256-CBC encrypted): After Attack: in DB (decrypted): After Attack: in DB (decrypted): Impact Full Server Compromise via JWT Signing Key Takeover: 1. Forge arbitrary JWT tokens - Sign JWTs for any user UID, including administrator accounts, without any credentials. 2. Impersonate any user - Forge tokens to pass all checks, as they validate against the attacker-controlled secret. 3. Persistent administrative access - Even if legitimate administrators reset their credentials, the attacker retains control of the signing key until the deployment is fully decommissioned. 4. Export all user data - Authenticated GraphQL queries can retrieve all workspaces, collections, API keys, and team data. 5. Session hijacking - Overwriting invalidates existing sessions and allows the attacker to forge new ones. References CWE-915: Improper Control of Dynamically-Managed Object Properties OWASP Mass Assignment NestJS ValidationPipe whitelist option Credits Kira by Offgrid Security

Goal Reached Thanks to every supporter — we hit 100%!

Hoppscotch-backend Mass Assignment on Onboarding Endpoint Allows Unauthenticated JWT_SECRET Overwrite (CVE-2026-XXXX)

More from this source