Hyperswitch through 1.128.0 Missing Authorization in Payout Confirmation
Hyperswitch through 1.128.0 lets client-authenticated payout confirmation requests set merchant-owned payout fields such as amount, currency, connector and routing. Fixed in 2026.10.19.0.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Fix
- Fixed in 2026.10.19.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
Juspay Hyperswitch through 1.128.0 (and builds before 2026.10.19.0) contains a missing authorization vulnerability that allows unauthenticated attackers to confirm payouts with any client_secret via POST /payouts/{payout_id}/confirm. Attackers holding the merchant's publishable key and a payout_id can confirm payouts and overwrite amount, currency, connector, and routing fields to trigger unauthorized merchant payouts.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- juspay hyperswitch
through 1.128.0; fixed in 2026.10.19.0
References 7
GitHub · juspay/hyperswitch
abraxaslabs.tech
Questions about CVE-2026-119421
What does this mean?
Client-authenticated payout confirmation requests could set merchant-owned payout fields such as amount, currency, connector and routing, because the endpoint lacked the needed authorization check. The fix blocks these fields for client-authenticated confirmation.Source: github.com
Am I affected, and how do I check?
The listed affected range is Hyperswitch through 1.128.0, and the fixed range begins at 2026.10.19.0. The issue applies to the payouts confirm endpoint when it is reached with client authentication, so check whether your setup uses that path and which Hyperswitch version you run.Source: github.com
What should I do about it?
Upgrade Hyperswitch to 2026.10.19.0 or later.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data