Description
Juspay Hyperswitch through 1.128.0 (and builds before 2026.10.19.0) contains a missing authorization vulnerability that allows unauthenticated attackers to confirm payouts with any client_secret via POST /payouts/{payout_id}/confirm. Attackers holding the merchant's publishable key and a payout_id can confirm payouts and overwrite amount, currency, connector, and routing fields to trigger unauthorized merchant payouts.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
juspay hyperswitch
Default version status: unaffected
0 to ≤ 1.128.0affected0 to < 2026.10.19.0affected
References
- https://github.com/juspay/hyperswitch/commit/f1144ec5c7e38b3b048fe797fad57e743041f345 ↗
- https://github.com/juspay/hyperswitch/commit/607b15fcc4b7dae71c2aafb8c004eea333ac6fd8 ↗
- https://github.com/juspay/hyperswitch/blob/v1.128.0/crates/router/src/services/authentication.rs#L5921-L5927 ↗
- https://github.com/juspay/hyperswitch/blob/2026.09.21.0/crates/router/src/core/payouts/helpers.rs#L1465 ↗
- https://abraxaslabs.tech/research/hyperswitch-payout-confirm-secret ↗
- https://github.com/juspay/hyperswitch ↗
- https://www.vulncheck.com/advisories/hyperswitch-through-1.128.0-missing-authorization-in-payout-confirmation ↗