CVE-2026-119421: Hyperswitch through 1.128.0 Missing Authorization in Payout Confirmation

Published Oct 30, 2026

Updated

Juspay Hyperswitch through 1.128.0 (and builds before 2026.10.19.0) contains a missing authorization vulnerability that allows unauthenticated attackers to confirm payouts with any clientsecret via POST /payouts/{payoutid}/confirm. Attackers holding the merchant's publishable key and a payoutid can confirm payouts and overwrite amount, currency, connector, and routing fields to trigger unauthorized merchant payouts.

Event History

Oct 30, 2026

CVE Published

via MITRE·11:30 AM

Data Sourced

via MITRE·11:30 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Hyperswitch versions through 1.128.0 and builds before 2026.10.19.0 are affected. Exposure applies to deployments where an attacker can obtain a merchant publishable key and a payout ID.

What does an attacker need to exploit this issue?

The attacker needs the merchant's publishable key and a payout_id. No authenticated account or user interaction is required, although the attack complexity is rated high.

What can a successful attacker do?

An attacker can call the payout confirmation endpoint using any client_secret to confirm a payout. They can overwrite the payout amount, currency, connector, and routing fields, potentially triggering unauthorized payouts.

CVE-2026-119421: Hyperswitch through 1.128.0 Missing Authorization in Payout Confirmation

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What can a successful attacker do?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What can a successful attacker do?