Missing Authorization Vulnerability in Juspay Hyperswitch

CVE-2026-119421

What is CVE-2026-119421?

The Juspay Hyperswitch up to version 1.128.0 suffers from a missing authorization vulnerability that permits unauthenticated attackers to confirm payouts using any client secret. By leveraging the merchant's publishable key and a valid payout ID, adversaries can manipulate payout details, allowing them to alter amounts, currencies, connectors, and routing fields, which can lead to unauthorized payout transactions. This vulnerability poses a significant risk to platforms relying on Juspay for secure payment processing.

References