Authentication bypass in Juspay Hyperswitch Worldpayxml webhooks
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-345.
Summary
Juspay Hyperswitch before 1.128.0 and before 2026.10.01.0 has an authentication bypass in the Worldpayxml connector webhook handling (CWE-345). The connector's webhook source verification always succeeds without enforced mutual TLS, so the authenticity of incoming data is not checked. An unauthenticated remote attacker who knows the merchant ID and Worldpay order code can forge payment status updates, marking unpaid payments as charged or triggering refund, dispute and payout events.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
Description from the CNA
Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verify_webhook_source always returns true without enforced mTLS. Attackers knowing the merchant_id and Worldpay orderCode can POST unsigned XML with lastEvent SETTLED to the worldpayxml webhook endpoint, marking unpaid payments as charged or triggering refund, dispute and payout events.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Upgrade Juspay Hyperswitch to 1.128.0 or 2026.10.01.0, the fixed versions.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
- Fix · CNA hyperswitch (juspay) Fixed in 1.128.0, 2026.10.01.0
Timeline
- 2026-10-30 Threatist record created from CVE-2026-119422
- 2026-10-30 Alias added: GHSA-73m6-3vjm-8pf5
- 2026-10-30 CISA SSVC decision points changed
- 2026-10-30 Priority changed: MEDIUM → LOW
References
Patch 2
More juspay vulnerabilities
- TI-2026-83000 Missing authorization in Hyperswitch lets attackers confirm payouts CVSS 4.0HIGH 8.2
Sources
- CVE-2026-119422 · CVE Program
- CVE-2026-119422 · NVD
- FIRST EPSS
- GHSA-73m6-3vjm-8pf5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences