CVE-2026-50160: Mass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET Overwrite

Synopsis

This is a mass assignment vulnerability in the self-hosted backend of Hoppscotch, an API development platform. The unauthenticated POST /v1/onboarding/config endpoint accepts arbitrary extra fields in the request body and writes them directly to the database because NestJS ValidationPipe is not configured to strip unknown properties. An attacker who can reach the endpoint over the network with no credentials can overwrite the JWT_SECRET signing key, granting them the ability to forge authentication tokens for any account, including administrators, resulting in full server compromise. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment upstream publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network; an attacker must be able to send HTTP requests to the hoppscotch-backend service to exploit this vulnerability.

• AuthenticationNot required

  The /v1/onboarding/config endpoint requires no credentials, so any unauthenticated caller can submit a malicious request body.

• Victim interactionNot required

  No user action is needed; the attacker sends the request directly to the server without involving any other party.

• Attack complexityDetail

  Exploitation is reliable and condition-free: the attacker only needs to craft a JSON body with extra fields and send it to the endpoint before onboarding completes or when no users exist.

Blast Radius

• Attacker overwrites the JWT_SECRET value stored in the database, taking control of the application's token signing key.
• Using the forged signing key, the attacker mints valid JWT tokens for any user account, including administrators, without knowing any password.
• Attacker gains full administrative access to the Hoppscotch instance, including all stored API collections, environment secrets, and team workspaces.
• Confidentiality and integrity of all data held in the self-hosted deployment are fully compromised; the attacker can read, modify, or delete any resource the application manages.