CVE-2026-113603
mediumThe x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28.0, x402 PyPI 2.11.0 through 2.25.0, and Go module 2.16.0 through 2.28.0 contains an autho…
The x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28.0, x402 PyPI 2.11.0 through 2.25.0, and Go module 2.16.0 through 2.28.0 contains an authorization bypass vulnerability that allows paying clients to unlock unpaid routes by supplying a mismatched PaymentPayload.resource URL. Attackers can pay for the cheapest SIWX-protected route while setting resource.url to an expensive route, then repeatedly access it using only a SIGN-IN-WITH-X header without further payment.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/x402-foundation/x402/blob/go/v2.28.0/go/extensions/signinwithx/server.g... disclosure@vulncheck.com
- https://github.com/x402-foundation/x402/blob/npm-@x402/extensions@v2.28.0/typescript/packa... disclosure@vulncheck.com
- https://github.com/x402-foundation/x402/blob/pypi-x402@v2.25.0/python/x402/extensions/sign... disclosure@vulncheck.com
- https://github.com/x402-foundation/x402/issues/3838 disclosure@vulncheck.com
- https://github.com/x402-foundation/x402/pull/3840 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/x402-x402-extensions-2.3.1-through-2.28.0-siwx-paymen... disclosure@vulncheck.com