CVE-2026-119422

Publié : 30 octobre 2026

Modifié : 30 octobre 2026

Score CVSS

5.9

MEDIUM

Description détaillée

Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verify_webhook_source always returns true without enforced mTLS. Attackers knowing the merchant_id and Worldpay orderCode can POST unsigned XML with lastEvent SETTLED to the worldpayxml webhook endpoint, marking unpaid payments as charged or triggering refund, dispute and payout events.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Références et Patchs

https://abraxaslabs.tech/research/hyperswitch-unsigned-webhook https://github.com/juspay/hyperswitch https://github.com/juspay/hyperswitch/blob/v1.127.0/crates/hyperswitch_connectors/src/connectors/worldpayxml.rs#L1391-L1392 https://github.com/juspay/hyperswitch/commit/681cf96bbc888239daf669a71b0554e934210ee3 https://github.com/juspay/hyperswitch/commit/e797b36a1af204f4e4820c4938c6e4b10e9ae4fa https://github.com/juspay/hyperswitch/releases/tag/v1.128.0 https://www.vulncheck.com/advisories/hyperswitch-before-1.128.0-webhook-authentication-bypass-via-worldpayxml-connector

Dernières Vulnérabilités

CVE-2026-91915

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability. A high privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Script injection.

VOIR DÉTAILS

CVE-2026-91914

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Authentication Bypass by Spoofing vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Session theft.

VOIR DÉTAILS

CVE-2026-91913

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.

VOIR DÉTAILS