CVE-2026-119422
Received Received - Intake

Authentication Bypass in Juspay Hyperswitch via Worldpayxml Connector

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verify_webhook_source always returns true without enforced mTLS. Attackers knowing the merchant_id and Worldpay orderCode can POST unsigned XML with lastEvent SETTLED to the worldpayxml webhook endpoint, marking unpaid payments as charged or triggering refund, dispute and payout events.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119422
EUVD
EUVD-2026-113802

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
juspay hyperswitch 0
juspay hyperswitch 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Juspay Hyperswitch before version 1.128.0 has an authentication bypass flaw in the Worldpayxml connector. The verify_webhook_source function always returns true without requiring mTLS, allowing unauthenticated attackers to forge payment status updates. Attackers with knowledge of merchant_id and Worldpay orderCode can send unsigned XML with lastEvent SETTLED to the webhook endpoint, falsely marking unpaid payments as charged or triggering refunds, disputes, and payouts.

Impact Analysis

This vulnerability allows attackers to manipulate payment statuses without authentication. If exploited, it could lead to unauthorized charges, incorrect refunds, or false dispute claims, potentially causing financial losses for merchants or customers. Systems relying on Hyperswitch for payment processing are at risk of fraudulent transactions.

Compliance Impact

This vulnerability could violate compliance requirements related to data integrity and secure transactions. GDPR may be impacted if payment data is mishandled, while HIPAA could be affected if financial data tied to healthcare is compromised. Organizations must ensure payment systems meet regulatory standards for authentication and data protection.

Mitigation Strategies

Upgrade Juspay Hyperswitch to version 1.128.0 or later to address the authentication bypass in the Worldpayxml connector. Ensure mTLS is enforced for the webhook endpoint to prevent unsigned XML requests from being accepted.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119422. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart