CVE-2026-119421

Juspay Hyperswitch through 1.128.0 and builds before 2026.10.19.0 contains a missing authorization vulnerability that allows unauthenticated attackers to confirm payouts with any clientsecret via POST /payouts/payoutid/confirm. Attackers holding the merchant's publishable key and a payoutid can...

CVE-2026-119421 Hyperswitch through 1.128.0 Missing Authorization in Payout Confirmation

Juspay Hyperswitch through 1.128.0 and builds before 2026.10.19.0 contains a missing authorization vulnerability that allows unauthenticated attackers to confirm payouts with any clientsecret via POST /payouts/payoutid/confirm. Attackers holding the merchant's publishable key and a payoutid can...