{"id":"CVE-2026-119422","title":"Hyperswitch before 1.128.0 Webhook Authentication Bypass via Worldpayxml Connector","summary":"Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verify_webhook_source always returns true without…","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","cvssSource":"cna","cwe":["CWE-345"],"vendor":"juspay","product":"hyperswitch","affected":["hyperswitch < 1.128.0","hyperswitch < 2026.10.01.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-30T16:05:19.790859Z"},"published":"2026-10-30","updated":"2026-10-30","sourceUpdated":"2026-10-30T16:05:29.768Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-119422","references":[{"url":"https://github.com/juspay/hyperswitch/commit/681cf96bbc888239daf669a71b0554e934210ee3"},{"url":"https://github.com/juspay/hyperswitch/commit/e797b36a1af204f4e4820c4938c6e4b10e9ae4fa"},{"url":"https://github.com/juspay/hyperswitch/blob/v1.127.0/crates/hyperswitch_connectors/src/connectors/worldpayxml.rs#L1391-L1392"},{"url":"https://github.com/juspay/hyperswitch/releases/tag/v1.128.0","label":"hyperswitch v1.128.0 Release Notes"},{"url":"https://abraxaslabs.tech/research/hyperswitch-unsigned-webhook"},{"url":"https://github.com/juspay/hyperswitch"},{"url":"https://www.vulncheck.com/advisories/hyperswitch-before-1.128.0-webhook-authentication-bypass-via-worldpayxml-connector","label":"VulnCheck Advisory: Hyperswitch before 1.128.0 Webhook Authentication Bypass via Worldpayxml Connector"}],"tags":["cve.org"],"epss":0.00237,"epssPercentile":0.14901,"ingestedAt":"2026-11-05T16:24:31.053Z","slug":"CVE-2026-119422","body":"## Overview\n\nJuspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verify_webhook_source always returns true without enforced mTLS. Attackers knowing the merchant_id and Worldpay orderCode can POST unsigned XML with lastEvent SETTLED to the worldpayxml webhook endpoint, marking unpaid payments as charged or triggering refund, dispute and payout events.\n\n## Affected\n\n- `hyperswitch < 1.128.0`\n- `hyperswitch < 2026.10.01.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":32,"depthScoreParts":{"impact":32.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}