Live › vulnerability › CVE-2026-113603
Go to dashboardThe x402 SIWX server extension in the npm, PyPI and Go packages does not check that a payment matches the route it unlocks. A paying client can pay for a cheap route, point the payment's resource URL at an expensive route, and then reuse a sign-in header to access the expensive route without paying.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Servers that use the x402 payment protocol with the SIWX extension to protect paid routes are exposed, because the server trusts the resource URL supplied in the client's payment payload. Teams that do not use the SIWX extension, or that do not sell access to multiple priced routes through x402, can skip it.
No product ranges from the sources yet.
@x402/extensions in package.json or the lockfile, and of x402 in the Python environment (pip show x402), and the Go module version in go.mod.@x402/extensions past 2.28.0 (fixed version unknown from the sources).x402 package past 2.25.0 and the Go module past 2.28.0 (fixed versions unknown from the sources).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28.0, x402 PyPI 2.11.0 through 2.25.0, and Go module 2.16.0 through 2.28.0 contains an authorization bypass vulnerability that allows paying clients to unlock unpaid routes by supplying a mismatched PaymentPayload.resource URL. Attackers can pay for the cheapest SIWX-protected route while setting resource.url to an expensive route, then repeatedly access it using only a SIGN-IN-WITH-X header without further payment.
This page as .md · .json · in your agent: get_signal("CVE-2026-113603")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.