Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verify_webhook_source always returns true without enforced mTLS. Attackers knowing the merchant_id and Worldpay orderCode can POST unsigned XML with lastEvent SETTLED to the worldpayxml webhook endpoint, marking unpaid payments as charged or triggering refund, dispute and payout events.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/juspay/hyperswitch/commit/681cf96bbc888239daf669a71b0554e934210ee3 patch
- https://github.com/juspay/hyperswitch/commit/e797b36a1af204f4e4820c4938c6e4b10e9ae4fa patch
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 8.2 · juspayNVD modified 2026-10-30 11:30
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 7
- https://github.com/juspay/hyperswitch/commit/681cf96bbc888239daf669a71b0554e934210ee3 patch
- https://github.com/juspay/hyperswitch/commit/e797b36a1af204f4e4820c4938c6e4b10e9ae4fa patch
- https://github.com/juspay/hyperswitch/blob/v1.127.0/crates/hyperswitch_connectors/src/connectors/worldpayxml.rs#L1391-L1392 technical-description
- https://github.com/juspay/hyperswitch/releases/tag/v1.128.0 release-notes
- https://abraxaslabs.tech/research/hyperswitch-unsigned-webhook third-party-advisory
- https://github.com/juspay/hyperswitch product
- https://www.vulncheck.com/advisories/hyperswitch-before-1.128.0-webhook-authentication-bypass-via-worldpayxml-connector third-party-advisory