Is CVE-2026-119422 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-119422?

CVE-2026-119422 has a CVSS v3 severity of MEDIUM (5.9).

Back

CVE-2026-119422

Description

Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verify_webhook_source always returns true without enforced mTLS. Attackers knowing the merchant_id and Worldpay orderCode can POST unsigned XML with lastEvent SETTLED to the worldpayxml webhook endpoint, marking unpaid payments as charged or triggering refund, dispute and payout events.