CVE-2026-119421: falha de alta gravidade em juspay hyperswitch
Hyperswitch through 1.128.0 Missing Authorization in Payout Confirmation
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.2epss 0.3%
Juspay Hyperswitch through 1.128.0 (and builds before 2026.10.19.0) contains a missing authorization vulnerability that allows unauthenticated attackers to confirm payouts with any client_secret via POST /payouts/{payout_id}/confirm. Attackers holding the merchant's publishable key and a payout_id can confirm payouts and overwrite amount, currency, connector, and routing fields to trigger unauthorized merchant payouts.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
juspay · hyperswitchCVEs relacionadas — juspay hyperswitch
No mesmo produto, das mais perigosas para as menos.
Referências
https://abraxaslabs.tech/research/hyperswitch-payout-confirm-secrethttps://github.com/juspay/hyperswitchhttps://github.com/juspay/hyperswitch/blob/2026.09.21.0/crates/router/src/core/payouts/helpers.rs#L1465https://github.com/juspay/hyperswitch/blob/v1.128.0/crates/router/src/services/authentication.rs#L5921-L5927https://github.com/juspay/hyperswitch/commit/607b15fcc4b7dae71c2aafb8c004eea333ac6fd8https://github.com/juspay/hyperswitch/commit/f1144ec5c7e38b3b048fe797fad57e743041f345https://www.vulncheck.com/advisories/hyperswitch-through-1.128.0-missing-authorization-in-payout-confirmation