CVE-2026-119421— Hyperswitch through 1.128.0 Missing Authorization in Payout Confirmation

Quick assessment

Affected

juspay hyperswitch

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Juspay Hyperswitch 1.128.0 及更早版本（以及 2026 年 10 月 19 日之前的构建版本）存在一个缺失授权验证的漏洞。该漏洞允许未认证的攻击者通过向接口发送请求，利用任意来确认付款。若攻击者持有商户的可公开密钥（publishable key）和付款 ID（payout_id），即可确认付款，并篡改金额、币种、连接器（connector）及路由（routing）等字段，从而触发未经授权的商户付款操作。

CVSS 5.9 · Medium Updated Oct 30, 2026

Possible ATT&CK Techniques 2 AI

T1068 · Exploitation for Privilege Escalation T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Hyperswitch through 1.128.0 Missing Authorization in Payout Confirmation

Source: CVE Program / CVE List V5

Vulnerability Description

Juspay Hyperswitch through 1.128.0 (and builds before 2026.10.19.0) contains a missing authorization vulnerability that allows unauthenticated attackers to confirm payouts with any client_secret via POST /payouts/{payout_id}/confirm. Attackers holding the merchant's publishable key and a payout_id can confirm payouts and overwrite amount, currency, connector, and routing fields to trigger unauthorized merchant payouts.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

通过用户控制密钥绕过授权机制

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
juspay	hyperswitch	0 ~ 1.128.0	-

II. Public POCs for CVE-2026-119421

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119421

请登录查看更多情报信息。

Other References for CVE-2026-119421 (7)

https://github.com/juspay/hyperswitch/commit/f1144ec5c7e38b3b048fe797fad57e743041f345 patch
https://github.com/juspay/hyperswitch/blob/v1.128.0/crates/router/src/services/authentication.rs#L5921-L5927 technical-description
https://github.com/juspay/hyperswitch product
https://abraxaslabs.tech/research/hyperswitch-payout-confirm-secret third-party-advisory
https://github.com/juspay/hyperswitch/commit/607b15fcc4b7dae71c2aafb8c004eea333ac6fd8 patch
https://github.com/juspay/hyperswitch/blob/2026.09.21.0/crates/router/src/core/payouts/helpers.rs#L1465 technical-description
https://www.vulncheck.com/advisories/hyperswitch-through-1.128.0-missing-authorization-in-payout-confirmation third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119421

IV. Related Vulnerabilities

Same product: hyperswitch

CVE-2026-119422
Hyperswitch before 1.128.0 Webhook Authentication Bypass via

Same vendor: juspay

CVE-2026-119422
Hyperswitch before 1.128.0 Webhook Authentication Bypass via

Same weakness: CWE-639