CVE-2026-119422: falha de alta gravidade em juspay hyperswitch
Hyperswitch before 1.128.0 Webhook Authentication Bypass via Worldpayxml Connector
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.2epss 0.2%
Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verify_webhook_source always returns true without enforced mTLS. Attackers knowing the merchant_id and Worldpay orderCode can POST unsigned XML with lastEvent SETTLED to the worldpayxml webhook endpoint, marking unpaid payments as charged or triggering refund, dispute and payout events.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
juspay · hyperswitchCVEs relacionadas — juspay hyperswitch
No mesmo produto, das mais perigosas para as menos.
Referências
https://abraxaslabs.tech/research/hyperswitch-unsigned-webhookhttps://github.com/juspay/hyperswitchhttps://github.com/juspay/hyperswitch/blob/v1.127.0/crates/hyperswitch_connectors/src/connectors/worldpayxml.rs#L1391-L1392https://github.com/juspay/hyperswitch/commit/681cf96bbc888239daf669a71b0554e934210ee3https://github.com/juspay/hyperswitch/commit/e797b36a1af204f4e4820c4938c6e4b10e9ae4fahttps://github.com/juspay/hyperswitch/releases/tag/v1.128.0https://www.vulncheck.com/advisories/hyperswitch-before-1.128.0-webhook-authentication-bypass-via-worldpayxml-connector