Loading story…
Hoppscotch, the open source API development platform, patched two high-severity vulnerabilities in version 2026.3.0. CVE-2026-34931 is an improper loopback redirect_uri validation flaw in the device-login flow that creates an open redirect condition, allowing token exfiltration and potentially letting an attacker sign in as a victim and take over the victim’s account. The issue is classified as CWE-601 and is remotely exploitable with low attack complexity and no privileges required.
The same release also fixed CVE-2026-34932, a stored cross-site scripting vulnerability in mock server responses on the backend origin. The flaw, classified as CWE-79, can be used to trigger cross-site request forgery and requires user interaction, but is likewise network exploitable with low attack complexity and no prior privileges. Both issues affect Hoppscotch versions prior to 2026.3.0, making upgrade to the patched release the key remediation step.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Aikido disclosed a third vulnerability in Hoppscotch affecting versions through 2026.2.1: a broken access control issue that let a user move a request into another team’s collection by setting nextRequestID to null, potentially enabling credential or API key theft if executed by the victim team. The article said this issue was patched in version 2026.3.0 but was accidentally grouped with the XSS report, leaving two advisories to cover three distinct flaws.
GitHub security advisories received records for CVE-2026-34931 and CVE-2026-34932 on April 2, 2026. The disclosures documented the Hoppscotch vulnerabilities as CWE-601 and CWE-79 issues, respectively, with published CVSS v4.0 vectors.
Hoppscotch fixed two security flaws in release 2026.3.0: CVE-2026-34931, an improper loopback redirect_uri validation issue in the device-login flow that could enable token exfiltration and account takeover, and CVE-2026-34932, a stored XSS issue via mock server responses on the backend origin that could lead to CSRF. Both issues affected versions prior to 2026.3.0.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
aikido.dev
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
FreeScout disclosed two high-severity vulnerabilities affecting versions prior to **1.8.206** that can be exploited independently or chained: **CVE-2026-27637** (predictable authentication token) and **CVE-2026-27636** (unsafe file upload restrictions enabling Apache configuration abuse). CVE-2026-27637 stems from *TokenAuth* generating a static token as `MD5(user_id + created_at + APP_KEY)`; if an attacker obtains the Laravel `APP_KEY` (a commonly exposed secret in misconfigured deployments), they can compute valid tokens for arbitrary users, including administrators, resulting in **account takeover without a password**. CVE-2026-27636 is caused by FreeScout’s upload restriction list not blocking `.htaccess` and `.user.ini`; on Apache servers configured with `AllowOverride All`, an authenticated user can upload a `.htaccess` file to alter how files are processed and achieve **remote code execution**. Belgium’s CCB/Safeonweb urged immediate patching and noted no confirmed active exploitation as of **25 Feb 2026**, while emphasizing that help desk platforms often contain sensitive customer data and can be leveraged for lateral movement. FreeScout fixed both issues in **1.8.206** via upstream commits and published GitHub security advisories for each CVE.
Jun 29, 2026
OpenReplay fixed a critical stored cross-site scripting flaw, tracked as **`CVE-2026-55879`**, that affects versions **`1.24.0` before `1.25.0`** and can let an unauthenticated attacker take over dashboard accounts. The issue allows anyone with a public project key to submit malicious custom event names or page URLs that are stored by the platform and later rendered in the authenticated dashboard, where attacker-controlled JavaScript can execute in the dashboard origin, steal the session JWT from `localStorage`, and hijack user access. The vulnerability is rated **CVSS 9.3** and mapped to **`CWE-79`**. The remediation shipped in **OpenReplay `v1.25.0`** and was reflected in subsequent code changes that centralized output encoding for event read paths. The patch escapes event entries and nested property maps on the backend before returning data from `SearchEvents` and `GetEventByID`, and also hardens the frontend by escaping JSON shown in `EventDetailsModal`, replacing `innerHTML` with `textContent` in a text measurement helper, and adding a reusable HTML-escaping utility. Together, the changes indicate the flaw stemmed from unsanitized event content being inserted into the UI without proper output encoding.
Jul 11, 2026
The Apache Software Foundation released security updates for *Apache Syncope* to address vulnerabilities that could enable **session hijacking** and **sensitive data exposure** in identity-management deployments. One issue, **CVE-2026-23794**, is a **reflected XSS** flaw in the **Enduser Login** page where an attacker can trick a user into clicking a crafted link, leading to arbitrary JavaScript execution in the victim’s browser and potential theft of session cookies or actions performed as the user. A second issue, **CVE-2026-23795**, is an **XML External Entity (XXE)** vulnerability in the **Syncope Console** related to creating/editing **Keymaster parameters**; it requires an attacker to have (or obtain) administrator-level entitlements, but can then be used to submit malicious XML to trigger data leakage and potentially facilitate session compromise. Reported affected versions include **3.0–3.0.15** and **4.0–4.0.3**, with fixes available in **3.0.16** and **4.0.4**; organizations running impacted releases are advised to upgrade promptly, particularly given Syncope’s role in authentication and access control.
Jun 29, 2026