CVE-2026-119422: Hyperswitch before 1.128.0 Webhook Authentication Bypass via Worldpayxml Connector

Published Oct 30, 2026

Updated

Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verifywebhooksource always returns true without enforced mTLS. Attackers knowing the merchantid and Worldpay orderCode can POST unsigned XML with lastEvent SETTLED to the worldpayxml webhook endpoint, marking unpaid payments as charged or triggering refund, dispute and payout events.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Juspay Hyperswitch to a version that resolves this vulnerability.
Fixed in 1.128.0

Event History

Oct 30, 2026

CVE Published

via MITRE·11:30 AM

Data Sourced

via MITRE·11:30 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Hyperswitch versions before 1.128.0 are exposed when the Worldpayxml connector and its webhook endpoint are in use. The issue depends on webhook-source verification always succeeding and mTLS not being enforced.

What does an attacker need to exploit this?

An unauthenticated attacker needs the merchant_id and the Worldpay orderCode. They can then POST unsigned XML containing a lastEvent value of SETTLED to the Worldpayxml webhook endpoint.

What is the practical impact of a forged webhook?

A forged payment-status update can mark an unpaid payment as charged. It can also trigger refund, dispute, and payout events.

How can I determine whether I may already be affected?

Review whether your deployment runs a version before 1.128.0 and uses the Worldpayxml connector. Also inspect Worldpayxml webhook records for unsigned XML status updates, particularly SETTLED events, and validate their merchant_id and orderCode against expected payment activity.

What can be done if upgrading is not immediately possible?

Enforce mTLS for the Worldpayxml webhook path and prevent acceptance of unsigned webhook XML. Restrict access to that endpoint while validating payment, refund, dispute, and payout events through trusted records.

CVE-2026-119422: Hyperswitch before 1.128.0 Webhook Authentication Bypass via Worldpayxml Connector

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this?

What is the practical impact of a forged webhook?

How can I determine whether I may already be affected?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this?

What is the practical impact of a forged webhook?

How can I determine whether I may already be affected?

What can be done if upgrading is not immediately possible?