Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck

CVE-2026-119422Hyperswitch before 1.128.0 Webhook Authentication Bypass via Worldpayxml Connector

Medium 5.9

In plain English

A medium-severity insufficient verification of data authenticity in hyperswitch from juspay. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.2%top 85.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verify_webhook_source always returns true without enforced mTLS. Attackers knowing the merchant_id and Worldpay orderCode can POST unsigned XML with lastEvent SETTLED to the worldpayxml webhook endpoint, marking unpaid payments as charged or triggering refund, dispute and payout events.

Affected products (as reported)

Vendor	Product	Versions
juspay	hyperswitch	0 – before 1.128.00 – before 2026.10.01.0

Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

References

https://github.com/juspay/hyperswitch/commit/681cf96bbc888239daf669a71b0554e934210ee3 patch
https://github.com/juspay/hyperswitch/commit/e797b36a1af204f4e4820c4938c6e4b10e9ae4fa patch
https://github.com/juspay/hyperswitch/blob/v1.127.0/crates/hyperswitch_connectors/src/connectors/worldpayxml.rs#L1391-L1392 technical-description
hyperswitch v1.128.0 Release Notes release-notes
https://abraxaslabs.tech/research/hyperswitch-unsigned-webhook third-party-advisory
https://github.com/juspay/hyperswitch product
VulnCheck Advisory: Hyperswitch before 1.128.0 Webhook Authentication Bypass via Worldpayxml Connector third-party-advisory