CVE-2026-119421

MediumCVSS 5.9

Published: 30/10/2026(UTC)Updated: 30/10/2026(UTC)Translated: 30/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

28th percentile - higher than 28% of all known CVEs

Summary

Juspay Hyperswitch through 1.128.0 (and builds before 2026.10.19.0) contains a missing authorization vulnerability that allows unauthenticated attackers to confirm payouts with any client_secret via POST /payouts/{payout_id}/confirm. Attackers holding the merchant's publishable key and a payout_id can confirm payouts and overwrite amount, currency, connector, and routing fields to trigger unauthorized merchant payouts.

Risk Assessment

An attacker can initiate unauthorized fund payouts, causing direct financial losses and disrupting settlement processes. Knowledge of the publishable key and payout_id is required.

Recommendation

Update Juspay Hyperswitch to a version later than 1.128.0 (or a build after 2026.10.19.0) and implement additional authorization for payout confirmation operations.

Other vulnerabilities in Juspay Hyperswitch

CVE-2026-119422Medium
Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verify_webhook_source always returns true without enforced mTLS. Attackers knowing the merchant_id and Worldpay orderCode can POST unsigned XML with lastEvent SETTLED to the worldpayxml webhook endpoint, marking unpaid payments as charged or triggering refund, dispute and payout events.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS