Hyperswitch through 1.128.0 Missing Authorization in Payout Confirmation

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Juspay Hyperswitch through 1.128.0 (and builds before 2026.10.19.0) contains a missing authorization vulnerability that allows unauthenticated attackers to confirm payouts with any client_secret via POST /payouts/{payout_id}/confirm. Attackers holding the merchant's publishable key and a payout_id can confirm payouts and overwrite amount, currency, connector, and routing fields to trigger unauthorized merchant payouts.

Etkilenen sürümler1 yazılım

Kaynaklar9 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…ommit/f1144ec5c7e38b3b048fe797fad57e743041f345 Yama
• github.com/…ommit/607b15fcc4b7dae71c2aafb8c004eea333ac6fd8 Yama
• abraxaslabs.tech/research/hyperswitch-payout-confirm-secret Üçüncü taraf
• vulncheck.com/…0-missing-authorization-in-payout-confirmation Üçüncü taraf
• github.com/…0/crates/router/src/services/authentication.rs Diğer
• github.com/…21.0/crates/router/src/core/payouts/helpers.rs Diğer
• github.com/juspay/hyperswitch Diğer

Kayıt geçmişi

1. 30 Eki 2026 14:30Yayımlandı

İlgili açıklar

• 5,9 CVE-2026-119422Hyperswitch before 1.128.0 Webhook Authentication Bypass via Worldpayxml Connector
• 4,3 CVE-2026-119598Miaomiaowu before 0.9.3 Cross-User Proxy Provider Config Disclosure via external_subscription_id
• 4,3 CVE-2026-119596UNIT3D through 9.2.0 Private Playlist Disclosure via Playlist Zip Download
• 3,7 CVE-2026-119571Parse Server 9.7.0 before 9.10.5-alpha.10 Installation Update Misdirection via Installation ID
• 4,3 CVE-2026-119555Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Information Disclosure via core_grades_get_feedback
• 4,3 CVE-2026-119547Forgejo through 15.0.11, 16.0.7, and 17.0.1 Information Disclosure via /api/v1/user/keys/{id}