5.9
MediumCVSS 3.1 · from VulnCheck
CVE-2026-119422
Hyperswitch before 1.128.0 Webhook Authentication Bypass via Worldpayxml Connector
hyperswitch · CWE-345 · CWE-345Affectedhyperswitch
FixUpdate to 1.128.0, 2026.10.01.0 or newer
PublishedOct 30, 11:30 · VulnCheck
ScoredOct 30 · 5.9 · VulnCheck
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:09 UTC
What we know
No known exploitation. CISA KEV, checked 22:09 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
A successful attack can change data. CVSS impact.
Description
Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verify_webhook_source always returns true without enforced mTLS. Attackers knowing the merchant_id and Worldpay orderCode can POST unsigned XML with lastEvent SETTLED to the worldpayxml webhook endpoint, marking unpaid payments as charged or triggering refund, dispute and payout events.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed inhyperswitchbefore 1.128.01.128.0hyperswitchbefore 2026.10.01.02026.10.01.0
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known