CVE-2026-113603CWE-639

CVE-2026-113603

Medium · published October 20, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
20.5
In the wild
Unconfirmed
What it is

The x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28.0, x402 PyPI 2.11.0 through 2.25.0, and Go module 2.16.0 through 2.28.0 contains an authorization bypass vulnerability that allows paying clients to unlock unpaid routes by supplying a mismatched PaymentPayload.resource URL. Attackers can pay for the cheapest SIWX-protected route while setting resource.url to an expensive route, then repeatedly access it using only a SIGN-IN-WITH-X header without further payment.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00291 · 20.5th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-10-20T20:17Z
References (6)
https://github.com/x402-foundation/x402/blob/go/v2.28.0/go/extensions/signinwithx/server.go · [email protected]https://github.com/x402-foundation/x402/blob/npm-@x402/[email protected]/typescript/packages/extensions/src/sign-in-with-x/hooks.ts · [email protected]https://github.com/x402-foundation/x402/blob/[email protected]/python/x402/extensions/sign_in_with_x/hooks.py · [email protected]https://github.com/x402-foundation/x402/issues/3838 · [email protected]https://github.com/x402-foundation/x402/pull/3840 · [email protected]https://www.vulncheck.com/advisories/x402-x402-extensions-2.3.1-through-2.28.0-siwx-payment-bypass-via-paymentpayload-resource · [email protected]
EPSS history
Timeline
  • 22 OCT 03:29Z
    EPSS moved — → 0%
    epss
  • 20 OCT 15:40Z
    x402 @x402/extensions 2.3.1 through 2.28.0 SIWX Payment Bypass via PaymentPayload.resource
    cvelistv5
  • 20 OCT 15:40Z
    x402 @x402/extensions 2.3.1 through 2.28.0 SIWX Payment Bypass via PaymentPayload.resource
    cvelistv5