CVE-2026-119422 Details
Description
Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verify_webhook_source always returns true without enforced mTLS. Attackers knowing the merchant_id and Worldpay orderCode can POST unsigned XML with lastEvent SETTLED to the worldpayxml webhook endpoint, marking unpaid payments as charged or triggering refund, dispute and payout events.
An authentication bypass vulnerability has been identified in Juspay Hyperswitch versions prior to 1.128.0. This vulnerability allows unauthenticated attackers to forge payment status updates through the Worldpay XML connector. The issue arises because the connector's webhook source verification function always returns true, bypassing the requirement for mutual TLS (mTLS) authentication. Attackers who know the merchant ID and Worldpay order code can send unsigned XML payloads with a specified event status to the Worldpay XML webhook endpoint. This manipulation can falsely indicate that unpaid payments have been settled or trigger refund, dispute, and payout events.
Users can update to Hyperswitch version 1.128.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Juspay Hyperswitch | >= 0, < 1.128.0 >= 0, < 2026.10.01.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |