---
id: 2447
title: "Aikido Attack finds multiple 0-days in Hoppscotch"
source_domain: aikido.dev
source_url: "https://www.aikido.dev/blog/ai-pentest-hoppscotch-vulnerabilities"
published_at: "2026-04-08 00:00"
tags: ["ai-security", "zero-day", "account-takeover", "xss", "ai-pentesting", "open-redirect", "hoppscotch"]
phying_url: "https://phying.com/item/2447"
lang: en
---

# Aikido Attack finds multiple 0-days in Hoppscotch

## Summary

AI pentest agents found three 0-days in the open source API platform Hoppscotch: open redirect to account takeover, stored XSS via mock server, and broken access control—patched in 2026.3.0.

## Intelligence Metadata

- **Sources:** aikido.dev
- **Published:** 2026-04-08 00:00
- **Original:** https://www.aikido.dev/blog/ai-pentest-hoppscotch-vulnerabilities
- **Phying News:** https://phying.com/item/2447