hyperswitch vulnerabilities
CVEs whose affected-version data names the hyperswitch package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-119422Medium· 5.9Hyperswitch before 1.128.0 Webhook Authentication Bypass via Worldpayxml Connector
Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verify_webhook_source always returns true without…
▾ Sunlitjuspay · hyperswitchEPSS 0.24%via CVEORG
CVE-2026-119421Medium· 5.9Hyperswitch through 1.128.0 Missing Authorization in Payout Confirmation
Juspay Hyperswitch through 1.128.0 (and builds before 2026.10.19.0) contains a missing authorization vulnerability that allows unauthenticated attackers to confirm payouts with any client_secret via POST /payouts/{payout_id}/confirm. Att…
▾ Sunlitjuspay · hyperswitchEPSS 0.34%via CVEORG