CVE-2026-119421 Hyperswitch through 1.128.0 Missing Authorization in Payout Confirmation
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-119421?
CVE-2026-119421 is a high-severity vulnerability in juspay hyperswitch, published on 30 Oct 2026.
Official description
Juspay Hyperswitch through 1.128.0 (and builds before 2026.10.19.0) contains a missing authorization vulnerability that allows unauthenticated attackers to confirm payouts with any client_secret via POST /payouts/{payout_id}/confirm. Attackers holding the merchant's publishable key and a payout_id can confirm payouts and overwrite amount, currency, connector, and routing fields to trigger unauthorized merchant payouts.
Weakness: CWE-639
Which versions are affected by CVE-2026-119421?
How do I fix CVE-2026-119421?
No fix has been published for CVE-2026-119421 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-119421 being exploited?
There is no known exploitation of CVE-2026-119421 in the wild and no public exploit code.
Sources
Also known as GHSA-r242-wmj3-v8wv.