CVE-2026-119421

MediumCVSS 5.9/10Last modified Oct 30, 2026

Description

Juspay Hyperswitch through 1.128.0 (and builds before 2026.10.19.0) contains a missing authorization vulnerability that allows unauthenticated attackers to confirm payouts with any client_secret via POST /payouts/{payout_id}/confirm. Attackers holding the merchant's publishable key and a payout_id can confirm payouts and overwrite amount, currency, connector, and routing fields to trigger unauthorized merchant payouts.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
juspay	hyperswitch	<= 1.128.0; < 2026.10.19.0

References

Timeline

Published: Oct 30, 2026
Last modified: Oct 30, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1194225.9Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment sta CVE-2026-1194235.3OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the CVE-2026-1194246.8OPNsense core before 26.7.8 contains a configuration line injection vulnerability that allows authenticated users with wireless-edit privile CVE-2026-1194255.4OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthen CVE-2026-1194268.8phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypass CVE-2026-1194278.8phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated users to inject SQL via CVE-2026-1194285.8phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound conn CVE-2026-1194294.3phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authent CVE-2026-119434.8Akaunting 3.1.21 contains an authenticated stored cross-site scripting vulnerability in the document timeline shown on invoice and bill deta CVE-2026-1194317.7A server-side request forgery (SSRF) vulnerability exists in Foxit Workspace's file-upload functionality. Insufficient validation of user-su CVE-2026-1194328.7A stored cross-site scripting (XSS) vulnerability exists in the Foxit Workspace's file share preview functionality. An attacker could upload CVE-2026-1194337.7A server-side request forgery (SSRF) vulnerability exists in an undocumented API endpoint of Foxit Workspace due to insufficient validation