---
id: "CVE-2026-119421"
kind: "vulnerability"
aliases: ["CVE-2026-119421"]
title: "Hyperswitch: missing authorization lets anyone confirm and redirect payouts"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["hyperswitch", "package", "payments", "self-hosted"]
not_affected_if: ["build-2026.10.19.0-or-later", "managed-hosting"]
published_at: "2026-10-30T12:16:38+00:00"
first_seen_at: "2026-10-30T12:30:25+00:00"
updated_at: "2026-10-30T12:32:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119421", "first_seen_at": "2026-10-30T12:30:25+00:00"}]
---

# Hyperswitch: missing authorization lets anyone confirm and redirect payouts

Juspay Hyperswitch, an open-source payments switch, does not check authorization on its payout confirm endpoint, so unauthenticated callers can confirm payouts with any client_secret. An attacker holding a merchant's publishable key and a payout_id can overwrite amount, currency, connector and routing fields to trigger unauthorized merchant payouts.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the deployed Hyperswitch build version against the `2026.10.19.0` threshold named in the advisory.
- Review whether `POST /payouts/{payout_id}/confirm` is reachable from the internet through your gateway or load balancer.

## Fix

- Move to a Hyperswitch build at or after `2026.10.19.0`, as stated in the advisory.

## Timeline

- 2026-10-30T12:30:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119421

## From the sources

Juspay Hyperswitch through 1.128.0 (and builds before 2026.10.19.0) contains a missing authorization vulnerability that allows unauthenticated attackers to confirm payouts with any client_secret via POST /payouts/{payout_id}/confirm. Attackers holding the merchant's publishable key and a payout_id can confirm payouts and overwrite amount, currency, connector, and routing fields to trigger unauthorized merchant payouts.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_