Threats tagged 'ghsa-r242-wmj3-v8wv'

Juspay Hyperswitch versions through 1.128.0 and builds before 2026.10.19.0 have a missing authorization vulnerability. This flaw allows unauthenticated attackers, who possess the merchant's publishable key and a payout ID, to confirm payouts via a specific API endpoint. Attackers can overwrite payout details such as amount, currency, connector, and routing, enabling unauthorized merchant payouts.