The vulnerability allows an attacker who possesses only the merchant's publishable key and a valid payout identifier to post to /payouts/{payout_id}/confirm, thereby bypassing authorization checks. Through this vector, the attacker can alter the amount, currency, connector, and routing details, leading to the execution of unauthorized payouts on the merchant’s account. The impact is primarily financial loss, as funds are moved without the merchant’s consent, potentially harming the merchant’s cash flow and customer trust.

Juspay Hyperswitch v1.128.0 and earlier builds prior to 2026.10.19.0 are affected. The vulnerability exists in the router core payouts helper and the authentication services handling payout confirmation endpoints.

The CVSS score of 8.2 indicates high severity, yet the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Because any party with a merchant’s publishable key can exploit the flaw, the attack vector is likely to be remote over the internet. Attacks would succeed without authentication to the API, meaning the exposure is large and the risk to financial assets significant.