CVE-2026-119421
Received Received - Intake

Unauthenticated Payout Confirmation in Juspay Hyperswitch

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
Juspay Hyperswitch through 1.128.0 (and builds before 2026.10.19.0) contains a missing authorization vulnerability that allows unauthenticated attackers to confirm payouts with any client_secret via POST /payouts/{payout_id}/confirm. Attackers holding the merchant's publishable key and a payout_id can confirm payouts and overwrite amount, currency, connector, and routing fields to trigger unauthorized merchant payouts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119421
EUVD
EUVD-2026-113801

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
juspay hyperswitch 0
juspay hyperswitch 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-119421 is a missing authorization vulnerability in Juspay Hyperswitch through version 1.128.0 and builds before 2026.10.19.0. It allows unauthenticated attackers to confirm payouts by exploiting the /payouts/{payout_id}/confirm endpoint. Attackers with a merchant's publishable key and a valid payout ID can manipulate fields like amount, currency, connector, and routing to trigger unauthorized payouts without proper validation.

Detection Guidance

To detect this vulnerability, monitor HTTP POST requests to the /payouts/{payout_id}/confirm endpoint. Check if requests lack proper client_secret validation or allow field modifications like amount, currency, or routing without authentication. Use network traffic analysis tools like Wireshark or tcpdump to inspect payout confirmation requests for suspicious payloads.

Impact Analysis

This vulnerability enables attackers to initiate unauthorized payouts by manipulating payout details. Merchants using affected Hyperswitch versions risk financial losses due to fraudulent transactions. Unauthorized changes to payout amounts or routing could also disrupt legitimate payment operations and damage customer trust.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive payment data, violating GDPR's data protection requirements and HIPAA's safeguards for financial transactions. Non-compliance may result in legal penalties, reputational damage, and loss of customer trust due to potential data breaches or financial fraud.

Mitigation Strategies

Immediately upgrade Hyperswitch to versions after 2026.10.19.0 or 1.128.1 to apply the client_secret validation fix. Temporarily restrict access to the /payouts/{payout_id}/confirm endpoint via firewall rules or API gateways. Review and audit all recent payout confirmations for unauthorized changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119421. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart