Hyperswitch before 1.128.0 Webhook Authentication Bypass via Worldpayxml Connector

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verify_webhook_source always returns true without enforced mTLS. Attackers knowing the merchant_id and Worldpay orderCode can POST unsigned XML with lastEvent SETTLED to the worldpayxml webhook endpoint, marking unpaid payments as charged or triggering refund, dispute and payout events.

Etkilenen sürümler1 yazılım

Kaynaklar9 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…ommit/681cf96bbc888239daf669a71b0554e934210ee3 Yama
• github.com/…ommit/e797b36a1af204f4e4820c4938c6e4b10e9ae4fa Yama
• abraxaslabs.tech/research/hyperswitch-unsigned-webhook Üçüncü taraf
• vulncheck.com/…uthentication-bypass-via-worldpayxml-connector Üçüncü taraf
• github.com/…witch_connectors/src/connectors/worldpayxml.rs Diğer
• github.com/juspay/hyperswitch/releases/tag/v1.128.0 Diğer
• github.com/juspay/hyperswitch Diğer

Kayıt geçmişi

1. 30 Eki 2026 14:30Yayımlandı

İlgili açıklar

• 5,9 CVE-2026-119421Hyperswitch through 1.128.0 Missing Authorization in Payout Confirmation
• 6,8 CVE-2026-93008Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns configurations
• 8,8 CVE-2026-103402Session Smart Router ve Session Smart Conductor'da önbellek dosyalarında bütünlük doğrulaması eksikliği
• 5,3 CVE-2026-103330Sadad QA Payment 1.28 - Unauthenticated Arbitrary Order Payment Confirmation via Signature Bypass
• 5,3 CVE-2026-103313BitPay Gateway for WooCommerce <= 4.1.3 - Unauthenticated Payment Bypass via Payment Return Handler
• 7,5 CVE-2026-118377mews/pos'ta 3D Pay ve 3D Host geri çağrılarında hash doğrulaması eksik