HIGH 8.2 NVD
CVE-2026-119422
Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because
Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verify_webhook_source always returns true without enforced mTLS. Attackers knowing the merchant_id and Worldpay orderCode can POST unsigned XML with lastEvent SETTLED to the worldpayxml webhook endpoint, marking unpaid payments as charged or triggering refund, dispute and payout events.
References
- https://abraxaslabs.tech/research/hyperswitch-unsigned-webhook
- https://github.com/juspay/hyperswitch
- https://github.com/juspay/hyperswitch/blob/v1.127.0/crates/hyperswitch_connectors/src/conn
- https://github.com/juspay/hyperswitch/commit/681cf96bbc888239daf669a71b0554e934210ee3
- https://github.com/juspay/hyperswitch/commit/e797b36a1af204f4e4820c4938c6e4b10e9ae4fa
This high severity vulnerability with a CVSS score of 8.2 was published on 2026-10-30 via NVD.
vulnfeed aggregates 17475 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.