CVE-2026-119422— Hyperswitch before 1.128.0 Webhook Authentication Bypass via Worldpayxml Connector
Quick assessment
Affected
juspay hyperswitch
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Juspay Hyperswitch 在 1.128.0 版本之前存在一个认证绕过漏洞，允许未认证的攻击者伪造支付状态更新。该漏洞源于 Worldpayxml 连接器的 方法始终返回 ，且未强制实施 mTLS（双向 TLS）。攻击者若知晓商户 ID（merchant_id）和 Worldpay 订单号（orderCode），即可向 Worldpayxml 的 webhook 端点发送未签名的 XML 请求，其中将 设置为 ，从而将未支付的交易标记为已扣款，或触发退款、争议及付款事件。
Possible ATT&CK Techniques 3 AI
T1055 · Process Injection T1562 T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-119422
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Hyperswitch before 1.128.0 Webhook Authentication Bypass via Worldpayxml Connector
Source: CVE Program / CVE List V5
Vulnerability Description
Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verify_webhook_source always returns true without enforced mTLS. Attackers knowing the merchant_id and Worldpay orderCode can POST unsigned XML with lastEvent SETTLED to the worldpayxml webhook endpoint, marking unpaid payments as charged or triggering refund, dispute and payout events.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对数据真实性的验证不充分
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| juspay | hyperswitch | 0 ~ 1.128.0 | - |
|
II. Public POCs for CVE-2026-119422
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-119422
请登录查看更多情报信息。
Other References for CVE-2026-119422 (7)
-
https://abraxaslabs.tech/research/hyperswitch-unsigned-webhook third-party-advisory
IV. Related Vulnerabilities
Same weakness: CWE-345
-
CVE-2026-93008
Dnsmasq: dnsmasq: out-of-bailiwick cache injection through c -
CVE-2026-110985
Apache Kafka: Broker silently skips JWT signature verificati -
CVE-2026-110952
Apache Kafka: Broker does not enforce JWT issuer and audienc -
CVE-2026-103402
Session Smart Router and Session Smart Conductor: Lack of in -
CVE-2026-118377
mews/pos through 2.0.0 Missing Hash Verification in 3D Pay a