CVE-2026-119422
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verify_webhook_source always returns true without enforced mTLS. Attackers knowing the merchant_id and Worldpay orderCode can POST unsigned XML with lastEvent SETTLED to the worldpayxml webhook endpoint, marking unpaid payments as charged or triggering refund, dispute and payout events.
Risk Assessment
An attacker can falsely mark payments as charged or trigger refunds, disputes and payouts, causing financial losses and compromising transactional data integrity. Knowledge of merchant_id and orderCode is required.
Recommendation
Update Juspay Hyperswitch to version 1.128.0 or later and enable enforced mTLS and webhook signature verification.
Other vulnerabilities in Juspay Hyperswitch
Original NVD description (English source)
Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verify_webhook_source always returns true without enforced mTLS. Attackers knowing the merchant_id and Worldpay orderCode can POST unsigned XML with lastEvent SETTLED to the worldpayxml webhook endpoint, marking unpaid payments as charged or triggering refund, dispute and payout events.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS