https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-31T22:14:05.831799+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-119421 CVE-2026-119421 — Hyperswitch through 1.128.0 Missing Authorization in Payout Confirmation 2026-10-31T22:14:05.832730+00:00

Affected: juspay hyperswitch

Juspay Hyperswitch through 1.128.0 (and builds before 2026.10.19.0) contains a missing authorization vulnerability that allows unauthenticated attackers to confirm payouts with any client_secret via POST /payouts/{payout_id}/confirm. Attackers holding the merchant's publishable key and a payout_id can confirm payouts and overwrite amount, currency, connector, and routing fields to trigger unauthorized merchant payouts.