Aikido Attack finds multiple 0-days in Hoppscotch

Hoppscotch self-hosted instances (<=2026.2.1) contained three security flaws — an open-redirect enabling session token exfiltration and account takeover, a stored XSS in the Mock Server allowing script execution and data exfiltration, and an access-control flaw that permits injecting requests into other teams' collections — all responsibly disclosed and patched in 2026.3.0.