Threats tagged 'ghsa-73m6-3vjm-8pf5'

Juspay Hyperswitch versions before 1.128.0 have an authentication bypass vulnerability in the Worldpayxml connector. This flaw allows unauthenticated attackers to forge payment status updates by exploiting the verify_webhook_source function, which always returns true due to lack of enforced mTLS. Attackers who know the merchant_id and Worldpay orderCode can send unsigned XML with lastEvent set to SETTLED to the webhook endpoint, potentially marking unpaid payments as paid or triggering refund, dispute, and payout events.