Authentication Bypass in Juspay Hyperswitch Payment System
CVE-2026-119422

8.2HIGH

Key Information:

Vendor

Juspay

Status
Hyperswitch
Vendor
CVE Published:
30 October 2026

What is CVE-2026-119422?

The Juspay Hyperswitch payment system prior to version 1.128.0 suffers from an authentication bypass flaw in the Worldpayxml connector. This vulnerability allows unauthenticated attackers to manipulate payment statuses by sending unsigned XML payloads to the webhook endpoint without proper verification. The lack of enforced mutual TLS (mTLS) means that attackers possessing the merchant_id and Worldpay orderCode can exploit this weakness to falsely mark payments as completed or initiate refunds, disputes, and payouts.

Affected Version(s)

hyperswitch 0 < 1.128.0

hyperswitch 0 < 2026.10.01.0

References

https://github.com/juspay/hyperswitch/commit/681cf96bbc88...
patch
https://github.com/juspay/hyperswitch/commit/e797b36a1af2...
patch
https://github.com/juspay/hyperswitch/blob/v1.127.0/crate...
technical-description

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abraxas Labs
Nithin N
.