Live › vulnerability › CVE-2026-119422
Hyperswitch's Worldpayxml connector accepts webhook calls without verifying their source, so anyone who knows a merchant ID and Worldpay order code can send unsigned XML. An attacker can thereby mark unpaid payments as settled and trigger refund, dispute and payout events.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Self-hosted or managed Hyperswitch deployments that use the Worldpayxml connector and expose its webhook endpoint. Deployments on versions 1.128.0 or later, or without the Worldpayxml connector, are not affected per the description. Teams that only use other connectors can skip it.
No product ranges from the sources yet.
1.128.0.1.128.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verify_webhook_source always returns true without enforced mTLS. Attackers knowing the merchant_id and Worldpay orderCode can POST unsigned XML with lastEvent SETTLED to the worldpayxml webhook endpoint, marking unpaid payments as charged or triggering refund, dispute and payout events.
This page as .md · .json · in your agent: get_signal("CVE-2026-119422")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.