Live › vulnerability › CVE-2026-119421
Juspay Hyperswitch, an open-source payments switch, does not check authorization on its payout confirm endpoint, so unauthenticated callers can confirm payouts with any client_secret. An attacker holding a merchant's publishable key and a payout_id can overwrite amount, currency, connector and routing fields to trigger unauthorized merchant payouts.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Teams that self-host Juspay Hyperswitch through 1.128.0 or builds before 2026.10.19.0 and expose the payouts API to callers outside their network. The attacker needs the merchant's publishable key and a payout_id, so the exposure depends on how widely those values are known.
No product ranges from the sources yet.
2026.10.19.0 threshold named in the advisory.POST /payouts/{payout_id}/confirm is reachable from the internet through your gateway or load balancer.2026.10.19.0, as stated in the advisory.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Juspay Hyperswitch through 1.128.0 (and builds before 2026.10.19.0) contains a missing authorization vulnerability that allows unauthenticated attackers to confirm payouts with any client_secret via POST /payouts/{payout_id}/confirm. Attackers holding the merchant's publishable key and a payout_id can confirm payouts and overwrite amount, currency, connector, and routing fields to trigger unauthorized merchant payouts.
This page as .md · .json · in your agent: get_signal("CVE-2026-119421")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.