Hyperswitch
Monthly
Unauthenticated webhook forgery in Juspay Hyperswitch before 1.128.0 allows an attacker who knows a merchant_id and the matching Worldpay orderCode to POST unsigned XML into the worldpayxml webhook endpoint and drive payment state transitions - most damagingly a lastEvent value of SETTLED that marks an unpaid order as charged, with refund, dispute and payout events reachable by the same path. Only deployments that have the Worldpayxml connector enabled are exposed, and the connector's verify_webhook_source returned true unconditionally, so no signature check or mTLS stood between the request and the state machine. No CISA KEV entry has been recorded for this issue and there is no confirmation of active exploitation; a public research writeup describing the unsigned-webhook technique exists but is not verified as working exploit code, and the vendor has released fixes in v1.128.0 and 2026.10.01.0.
Unauthenticated attackers who hold a merchant's publishable key and a valid payout identifier can confirm payouts in Juspay Hyperswitch through 1.128.0 and in builds before 2026.10.19.0, because the confirmation handler does not compare the supplied client_secret with the payout's stored secret. A successful call can overwrite amount, currency, connector and routing fields and trigger unauthorized merchant payouts. The vendor has released a fix, the issue is prioritized for remediation this week rather than as an emergency, and a public research write-up is referenced but working exploit code is not confirmed in the supplied data.
Unauthenticated webhook forgery in Juspay Hyperswitch before 1.128.0 allows an attacker who knows a merchant_id and the matching Worldpay orderCode to POST unsigned XML into the worldpayxml webhook endpoint and drive payment state transitions - most damagingly a lastEvent value of SETTLED that marks an unpaid order as charged, with refund, dispute and payout events reachable by the same path. Only deployments that have the Worldpayxml connector enabled are exposed, and the connector's verify_webhook_source returned true unconditionally, so no signature check or mTLS stood between the request and the state machine. No CISA KEV entry has been recorded for this issue and there is no confirmation of active exploitation; a public research writeup describing the unsigned-webhook technique exists but is not verified as working exploit code, and the vendor has released fixes in v1.128.0 and 2026.10.01.0.
Unauthenticated attackers who hold a merchant's publishable key and a valid payout identifier can confirm payouts in Juspay Hyperswitch through 1.128.0 and in builds before 2026.10.19.0, because the confirmation handler does not compare the supplied client_secret with the payout's stored secret. A successful call can overwrite amount, currency, connector and routing fields and trigger unauthorized merchant payouts. The vendor has released a fix, the issue is prioritized for remediation this week rather than as an emergency, and a public research write-up is referenced but working exploit code is not confirmed in the supplied data.