---
id: CVE-2026-119422
title: >-
  Hyperswitch before 1.128.0 Webhook Authentication Bypass via Worldpayxml
  Connector
summary: >-
  Juspay Hyperswitch before 1.128.0 contains an authentication bypass
  vulnerability that allows unauthenticated attackers to forge payment status
  updates because the Worldpayxml connector's verify_webhook_source always
  returns true without…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-345
vendor: juspay
product: hyperswitch
affected:
  - hyperswitch < 1.128.0
  - hyperswitch < 2026.10.01.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-30T16:05:19.790859Z'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T16:05:29.768Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119422'
references:
  - url: >-
      https://github.com/juspay/hyperswitch/commit/681cf96bbc888239daf669a71b0554e934210ee3
  - url: >-
      https://github.com/juspay/hyperswitch/commit/e797b36a1af204f4e4820c4938c6e4b10e9ae4fa
  - url: >-
      https://github.com/juspay/hyperswitch/blob/v1.127.0/crates/hyperswitch_connectors/src/connectors/worldpayxml.rs#L1391-L1392
  - url: 'https://github.com/juspay/hyperswitch/releases/tag/v1.128.0'
    label: hyperswitch v1.128.0 Release Notes
  - url: 'https://abraxaslabs.tech/research/hyperswitch-unsigned-webhook'
  - url: 'https://github.com/juspay/hyperswitch'
  - url: >-
      https://www.vulncheck.com/advisories/hyperswitch-before-1.128.0-webhook-authentication-bypass-via-worldpayxml-connector
    label: >-
      VulnCheck Advisory: Hyperswitch before 1.128.0 Webhook Authentication
      Bypass via Worldpayxml Connector
tags:
  - cve.org
epss: 0.00237
epssPercentile: 0.14901
ingestedAt: '2026-11-05T16:24:31.053Z'
---

## Overview

Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verify_webhook_source always returns true without enforced mTLS. Attackers knowing the merchant_id and Worldpay orderCode can POST unsigned XML with lastEvent SETTLED to the worldpayxml webhook endpoint, marking unpaid payments as charged or triggering refund, dispute and payout events.

## Affected

- `hyperswitch < 1.128.0`
- `hyperswitch < 2026.10.01.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.