CVE-2026-119422

Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verifywebhooksource always returns true without enforced mTLS. Attackers knowing the merchantid and Worldpay...

CVE-2026-119421

Juspay Hyperswitch through 1.128.0 and builds before 2026.10.19.0 contains a missing authorization vulnerability that allows unauthenticated attackers to confirm payouts with any clientsecret via POST /payouts/payoutid/confirm. Attackers holding the merchant's publishable key and a payoutid can...

CVE-2026-119422 Hyperswitch before 1.128.0 Webhook Authentication Bypass via Worldpayxml Connector

Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verifywebhooksource always returns true without enforced mTLS. Attackers knowing the merchantid and Worldpay...

CVE-2026-119421 Hyperswitch through 1.128.0 Missing Authorization in Payout Confirmation

Juspay Hyperswitch through 1.128.0 and builds before 2026.10.19.0 contains a missing authorization vulnerability that allows unauthenticated attackers to confirm payouts with any clientsecret via POST /payouts/payoutid/confirm. Attackers holding the merchant's publishable key and a payoutid can...

EUVD-2026-113802

Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verifywebhooksource always returns true without enforced mTLS. Attackers knowing the merchantid and Worldpay...

EUVD-2026-113801

Juspay Hyperswitch through 1.128.0 and builds before 2026.10.19.0 contains a missing authorization vulnerability that allows unauthenticated attackers to confirm payouts with any clientsecret via POST /payouts/payoutid/confirm. Attackers holding the merchant's publishable key and a payoutid can...

CVE-2026-119422 Hyperswitch before 1.128.0 Webhook Authentication Bypass via Worldpayxml Connector

Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verifywebhooksource always returns true without enforced mTLS. Attackers knowing the merchantid and Worldpay...

CVE-2026-119421 Hyperswitch through 1.128.0 Missing Authorization in Payout Confirmation

Juspay Hyperswitch through 1.128.0 and builds before 2026.10.19.0 contains a missing authorization vulnerability that allows unauthenticated attackers to confirm payouts with any clientsecret via POST /payouts/payoutid/confirm. Attackers holding the merchant's publishable key and a payoutid can...

CVE-2026-119421

The Juspay Hyperswitch platform (versions through 1.128.0 and builds before 2026.10.19.0 ) is susceptible to a missing authorization vulnerability (CWE-639). An unauthenticated attacker possessing a merchant's publishable key and a payout_id can perform a POST request to /payouts/{payout_id}/conf...

CVE-2026-119422

Juspay Hyperswitch before version 1.128.0 is vulnerable to an authentication bypass in the Worldpayxml connector . The root cause is that the verify_webhook_source function always returns true without enforcing mTLS , allowing unauthenticated attackers to forge payment status updates. By providin...

PT-2026-133475

Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verify webhook source always returns true without enforced mTLS. Attackers knowing the merchant id and Worldp...

PT-2026-133474

Juspay Hyperswitch through 1.128.0 and builds before 2026.10.19.0 contains a missing authorization vulnerability that allows unauthenticated attackers to confirm payouts with any client secret via POST /payouts/payout id/confirm. Attackers holding the merchant's publishable key and a payout id ca...

hyperswitch-unsigned-webhook

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · hyperswitch-unsigned-webhook Write-up: https://abraxaslabs.tech/research/hyperswitch-unsigned-webhook hyperswitch-unsigned-webhook Hyperswitch 2026.09.21.0 - Juspay Worldpayxml::verifywebhooksource returns Oktrue with...