Threats affecting pkg:github/hyperswitch

Juspay Hyperswitch versions before 1.128.0 contain an authentication bypass vulnerability in the Worldpayxml connector. The verify_webhook_source function always returns true without enforcing mutual TLS, allowing unauthenticated attackers who know the merchant_id and Worldpay orderCode to forge payment status updates. This can result in marking unpaid payments as charged or triggering refund, dispute, and payout events.

Juspay Hyperswitch versions up to 1.128.0 and builds before 2026.10.19.0 contain an authorization bypass vulnerability. This flaw allows unauthenticated attackers who possess the merchant's publishable key and a payout ID to confirm payouts via the POST /payouts/{payout_id}/confirm endpoint. Attackers can overwrite payout details such as amount, currency, connector, and routing, enabling unauthorized merchant payouts. The issue is fixed in version 2026.10.19.0.