EUVD lists Juspay Hyperswitch missing authorization on payout confirmation (EUVD-2026-113801)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Juspay
- Product
- Hyperswitch
- First seen
Summary
The EUVD record, shared via a Mastodon post, describes a missing authorization flaw in Juspay Hyperswitch through 1.128.0, scored 8.2/10 (CVSS v3.1). The item says unauthenticated attackers can confirm payouts using any client_secret via POST /payouts/{payout_id}/confirm.
If you use Juspay
Upgrade Hyperswitch to version 1.128.0 or later, or a build dated 2026.10.19.0 or later
Review recent payout confirmations for unexpected activity
Restrict network access to the payouts API until patched
Upgrade Hyperswitch to version 1.128.0 or later
Reconcile recent payment statuses against the payment processor's records
Verify webhook sources for the Worldpayxml connector until patched
What the sources say 2
· Mastodon: “Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verify_webhook_source always returns true without en...” Source
· Mastodon: “Juspay Hyperswitch through 1.128.0 (and builds before 2026.10.19.0) contains a missing authorization vulnerability that allows unauthenticated attackers to confirm payouts with any client_secret via POST /payouts/{payout_id}/confirm.” Source