{"id":"CVE-2026-119422","kind":"vulnerability","aliases":["CVE-2026-119422"],"related":[],"title":"Juspay Hyperswitch: forged Worldpay webhooks mark unpaid payments as charged","description":"Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verify_webhook_source always returns true without enforced mTLS. Attackers knowing the merchant_id and Worldpay orderCode can POST unsigned XML with lastEvent SETTLED to the worldpayxml webhook endpoint, marking unpaid payments as charged or triggering refund, dispute and payout events.","summary":"Hyperswitch's Worldpayxml connector accepts webhook calls without verifying their source, so anyone who knows a merchant ID and Worldpay order code can send unsigned XML. An attacker can thereby mark unpaid payments as settled and trigger refund, dispute and payout events.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hyperswitch","package","payments","self-hosted","worldpay"],"not_affected_if":["fixed-version","no-worldpayxml-connector"],"how_to_check":"- Check the Hyperswitch version in use; affected releases are those before `1.128.0`.\n- Confirm whether the Worldpayxml connector is enabled and whether its webhook endpoint is reachable from the internet.","fix":"- Hyperswitch: upgrade to `1.128.0` or later.","status":"open","published_at":"2026-10-30T12:16:39+00:00","first_seen_at":"2026-10-30T12:30:25+00:00","triaged_at":"2026-10-30T12:32:13+00:00","updated_at":"2026-10-30T12:32:13+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T12:32:13Z","model":"claude-haiku-5-5","output":{"fix":"- Hyperswitch: upgrade to `1.128.0` or later.","reach":"internet","title":"Juspay Hyperswitch: forged Worldpay webhooks mark unpaid payments as charged","impact":"high","summary":"Hyperswitch's Worldpayxml connector accepts webhook calls without verifying their source, so anyone who knows a merchant ID and Worldpay order code can send unsigned XML. An attacker can thereby mark unpaid payments as settled and trigger refund, dispute and payout events.","audience":"businesses","category":"package","nicknames":[],"who_cares":["hyperswitch","payments","worldpay","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker marks unpaid payments as charged and triggers refunds.","analyst_note":"Confirm from the NVD entry or the Hyperswitch advisory whether mTLS enforcement is a required configuration for the fix, and whether the fixed version is exactly 1.128.0.","how_to_check":"- Check the Hyperswitch version in use; affected releases are those before `1.128.0`.\n- Confirm whether the Worldpayxml connector is enabled and whether its webhook endpoint is reachable from the internet.\n- unknown whether mTLS is enforced at the ingress for that endpoint; the sources do not say how to verify it.","plain_action":"","needs_analyst":true,"not_affected_if":["no-worldpayxml-connector","fixed-version"],"who_is_affected":"Self-hosted or managed Hyperswitch deployments that use the Worldpayxml connector and expose its webhook endpoint. Deployments on versions `1.128.0` or later, or without the Worldpayxml connector, are not affected per the description. Teams that only use other connectors can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000753,"input_tokens":4201,"output_tokens":666,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119422':13A,16A '-2026':12A,15A '1.128.0':69C 'accept':28B 'allow':76C 'alway':92C 'anyon':36B 'attack':51B,78C,98C 'authent':72C 'bypass':73C 'call':30B 'charg':10A,122C 'code':45B 'connector':27B,87C 'contain':70C 'cve':11A,14A 'disput':62B,126C 'endpoint':117C 'enforc':96C 'event':65B,129C 'forg':3A,80C 'host':22B 'hyperswitch':2A,17B,24B,67C 'id':41B,102C 'juspay':1A,66C 'know':38B,99C 'lastev':111C 'mark':6A,54B,118C 'merchant':40B,101C 'mtls':97C 'order':44B 'ordercod':105C 'packag':18B 'payment':8A,19B,56B,81C,120C 'payout':64B,128C 'post':107C 'refund':61B,125C 'return':93C 'self':21B 'self-host':20B 'send':47B 'settl':58B,112C 'sourc':34B,91C 'status':82C 'therebi':53B 'trigger':60B,124C 'true':94C 'unauthent':77C 'unpaid':7A,55B,119C 'unsign':48B,108C 'updat':83C 'verifi':32B,89C 'vulner':74C 'webhook':5A,29B,90C,116C 'without':31B,95C 'worldpay':4A,23B,43B,104C 'worldpayxml':26B,86C,115C 'xml':49B,109C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or managed Hyperswitch deployments that use the Worldpayxml connector and expose its webhook endpoint. Deployments on versions `1.128.0` or later, or without the Worldpayxml connector, are not affected per the description. Teams that only use other connectors can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T12:16:39+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119422","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119422","severity":null,"published_at":"2026-10-30T12:16:39+00:00","modified_at":"2026-10-30T12:16:39+00:00","first_seen_at":"2026-10-30T12:30:25+00:00","fetched_at":"2026-10-30T12:30:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}