CVE-2026-113603
- Source
- https://cve.org/CVERecord?id=CVE-2026-113603
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-113603.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-113603
- Published
- 2026-10-20T15:40:30Z
- Modified
- 2026-10-22T02:30:50Z
- Severity
-
- 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- x402 @x402/extensions 2.3.1 through 2.28.0 SIWX Payment Bypass via PaymentPayload.resource
- Details
-
The x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28.0, x402 PyPI 2.11.0 through 2.25.0, and Go module 2.16.0 through 2.28.0 contains an authorization bypass vulnerability that allows paying clients to unlock unpaid routes by supplying a mismatched PaymentPayload.resource URL. Attackers can pay for the cheapest SIWX-protected route while setting resource.url to an expensive route, then repeatedly access it using only a SIGN-IN-WITH-X header without further payment.
- Database specific
{ "cna_assigner": "VulnCheck", "cwe_ids": [ "CWE-639" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113603.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113603.json
- https://github.com/x402-foundation/x402
- https://github.com/x402-foundation/x402/blob/go/v2.28.0/go/extensions/signinwithx/server.go
- https://github.com/x402-foundation/x402/blob/npm-@x402/extensions@v2.28.0/typescript/packages/extensions/src/sign-in-with-x/hooks.ts
- https://github.com/x402-foundation/x402/blob/pypi-x402@v2.25.0/python/x402/extensions/sign_in_with_x/hooks.py
- https://github.com/x402-foundation/x402/issues/3838
- https://github.com/x402-foundation/x402/pull/3840
- https://nvd.nist.gov/vuln/detail/CVE-2026-113603
- https://www.vulncheck.com/advisories/x402-x402-extensions-2.3.1-through-2.28.0-siwx-payment-bypass-via-paymentpayload-resource
Affected packages
Git / github.com/x402-foundation/x402
Affected ranges
- Type
- GIT
- Repo
- https://github.com/x402-foundation/x402
- Events
-
IntroducedLast AffectedIntroducedLast AffectedIntroducedLast Affected
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "2.3.1" }, { "last_affected": "2.28.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "range": [ { "introduced": "2.11.0" }, { "last_affected": "2.25.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "range": [ { "introduced": "2.16.0" }, { "last_affected": "2.28.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" } ] }
Affected versions
go-x402@v2.*
go-x402@v2.19.0
go-x402@v2.20.0
go-x402@v2.21.0
go-x402@v2.22.0
go-x402@v2.23.0
go-x402@v2.24.0
go-x402@v2.25.0
go-x402@v2.26.0
go-x402@v2.27.0
go-x402@v2.28.0
go/v2.*
go/v2.19.0
go/v2.20.0
go/v2.21.0
go/v2.22.0
go/v2.23.0
go/v2.24.0
go/v2.25.0
go/v2.26.0
go/v2.27.0
go/v2.28.0
npm-@x402/aptos@v2.*
npm-@x402/aptos@v2.19.0
npm-@x402/aptos@v2.20.0
npm-@x402/aptos@v2.21.0
npm-@x402/aptos@v2.22.0
npm-@x402/aptos@v2.23.0
npm-@x402/aptos@v2.24.0
npm-@x402/aptos@v2.25.0
npm-@x402/aptos@v2.26.0
npm-@x402/aptos@v2.27.0
npm-@x402/aptos@v2.28.0
npm-@x402/avm@v2.*
npm-@x402/avm@v2.19.0
npm-@x402/avm@v2.20.0
npm-@x402/avm@v2.21.0
npm-@x402/avm@v2.22.0
npm-@x402/avm@v2.23.0
npm-@x402/avm@v2.24.0
npm-@x402/avm@v2.25.0
npm-@x402/avm@v2.26.0
npm-@x402/avm@v2.27.0
npm-@x402/avm@v2.28.0
npm-@x402/axios@v2.*
npm-@x402/axios@v2.19.0
npm-@x402/axios@v2.20.0
npm-@x402/axios@v2.21.0
npm-@x402/axios@v2.22.0
npm-@x402/axios@v2.23.0
npm-@x402/axios@v2.24.0
npm-@x402/axios@v2.25.0
npm-@x402/axios@v2.26.0
npm-@x402/axios@v2.27.0
npm-@x402/axios@v2.28.0
npm-@x402/cardano@v2.*
npm-@x402/cardano@v2.26.0
npm-@x402/cardano@v2.27.0
npm-@x402/cardano@v2.28.0
npm-@x402/casper@v2.*
npm-@x402/casper@v2.26.0
npm-@x402/casper@v2.27.0
npm-@x402/casper@v2.28.0
npm-@x402/concordium@v2.*
npm-@x402/concordium@v2.19.0
npm-@x402/concordium@v2.20.0
npm-@x402/concordium@v2.21.0
npm-@x402/concordium@v2.22.0
npm-@x402/concordium@v2.23.0
npm-@x402/concordium@v2.24.0
npm-@x402/concordium@v2.25.0
npm-@x402/concordium@v2.26.0
npm-@x402/concordium@v2.27.0
npm-@x402/concordium@v2.28.0
npm-@x402/core@v2.*
npm-@x402/core@v2.19.0
npm-@x402/core@v2.20.0
npm-@x402/core@v2.21.0
npm-@x402/core@v2.22.0
npm-@x402/core@v2.23.0
npm-@x402/core@v2.24.0
npm-@x402/core@v2.25.0
npm-@x402/core@v2.26.0
npm-@x402/core@v2.27.0
npm-@x402/core@v2.28.0
npm-@x402/evm@v2.*
npm-@x402/evm@v2.19.0
npm-@x402/evm@v2.20.0
npm-@x402/evm@v2.21.0
npm-@x402/evm@v2.22.0
npm-@x402/evm@v2.23.0
npm-@x402/evm@v2.24.0
npm-@x402/evm@v2.25.0
npm-@x402/evm@v2.26.0
npm-@x402/evm@v2.27.0
npm-@x402/evm@v2.28.0
npm-@x402/express@v2.*
npm-@x402/express@v2.19.0
npm-@x402/express@v2.20.0
npm-@x402/express@v2.21.0
npm-@x402/express@v2.22.0
npm-@x402/express@v2.23.0
npm-@x402/express@v2.24.0
npm-@x402/express@v2.25.0
npm-@x402/express@v2.26.0
npm-@x402/express@v2.27.0
npm-@x402/express@v2.28.0
npm-@x402/extensions@v2.*
npm-@x402/extensions@v2.19.0
npm-@x402/extensions@v2.20.0
npm-@x402/extensions@v2.21.0
npm-@x402/extensions@v2.22.0
npm-@x402/extensions@v2.23.0
npm-@x402/extensions@v2.24.0
npm-@x402/extensions@v2.25.0
npm-@x402/extensions@v2.26.0
npm-@x402/extensions@v2.27.0
npm-@x402/extensions@v2.28.0
npm-@x402/fastify@v2.*
npm-@x402/fastify@v2.19.0
npm-@x402/fastify@v2.20.0
npm-@x402/fastify@v2.21.0
npm-@x402/fastify@v2.22.0
npm-@x402/fastify@v2.23.0
npm-@x402/fastify@v2.24.0
npm-@x402/fastify@v2.25.0
npm-@x402/fastify@v2.26.0
npm-@x402/fastify@v2.27.0
npm-@x402/fastify@v2.28.0
npm-@x402/fetch@v2.*
npm-@x402/fetch@v2.19.0
npm-@x402/fetch@v2.20.0
npm-@x402/fetch@v2.21.0
npm-@x402/fetch@v2.22.0
npm-@x402/fetch@v2.23.0
npm-@x402/fetch@v2.24.0
npm-@x402/fetch@v2.25.0
npm-@x402/fetch@v2.26.0
npm-@x402/fetch@v2.27.0
npm-@x402/fetch@v2.28.0
npm-@x402/hedera@v2.*
npm-@x402/hedera@v2.19.0
npm-@x402/hedera@v2.20.0
npm-@x402/hedera@v2.21.0
npm-@x402/hedera@v2.22.0
npm-@x402/hedera@v2.23.0
npm-@x402/hedera@v2.24.0
npm-@x402/hedera@v2.25.0
npm-@x402/hedera@v2.26.0
npm-@x402/hedera@v2.27.0
npm-@x402/hedera@v2.28.0
npm-@x402/hono@v2.*
npm-@x402/hono@v2.19.0
npm-@x402/hono@v2.20.0
npm-@x402/hono@v2.21.0
npm-@x402/hono@v2.22.0
npm-@x402/hono@v2.23.0
npm-@x402/hono@v2.24.0
npm-@x402/hono@v2.25.0
npm-@x402/hono@v2.26.0
npm-@x402/hono@v2.27.0
npm-@x402/hono@v2.28.0
npm-@x402/keeta@v2.*
npm-@x402/keeta@v2.19.0
npm-@x402/keeta@v2.20.0
npm-@x402/keeta@v2.21.0
npm-@x402/keeta@v2.22.0
npm-@x402/keeta@v2.23.0
npm-@x402/keeta@v2.24.0
npm-@x402/keeta@v2.25.0
npm-@x402/keeta@v2.26.0
npm-@x402/keeta@v2.27.0
npm-@x402/keeta@v2.28.0
npm-@x402/mcp@v2.*
npm-@x402/mcp@v2.19.0
npm-@x402/mcp@v2.20.0
npm-@x402/mcp@v2.21.0
npm-@x402/mcp@v2.22.0
npm-@x402/mcp@v2.23.0
npm-@x402/mcp@v2.24.0
npm-@x402/mcp@v2.25.0
npm-@x402/mcp@v2.26.0
npm-@x402/mcp@v2.27.0
npm-@x402/mcp@v2.28.0
npm-@x402/near@v2.*
npm-@x402/near@v2.19.0
npm-@x402/near@v2.20.0
npm-@x402/near@v2.21.0
npm-@x402/near@v2.22.0
npm-@x402/near@v2.23.0
npm-@x402/near@v2.24.0
npm-@x402/near@v2.25.0
npm-@x402/near@v2.26.0
npm-@x402/near@v2.27.0
npm-@x402/near@v2.28.0
npm-@x402/next@v2.*
npm-@x402/next@v2.19.0
npm-@x402/next@v2.20.0
npm-@x402/next@v2.21.0
npm-@x402/next@v2.22.0
npm-@x402/next@v2.23.0
npm-@x402/next@v2.24.0
npm-@x402/next@v2.25.0
npm-@x402/next@v2.26.0
npm-@x402/next@v2.27.0
npm-@x402/next@v2.28.0
npm-@x402/paywall@v2.*
npm-@x402/paywall@v2.19.0
npm-@x402/paywall@v2.20.0
npm-@x402/paywall@v2.21.0
npm-@x402/paywall@v2.22.0
npm-@x402/paywall@v2.23.0
npm-@x402/paywall@v2.24.0
npm-@x402/paywall@v2.25.0
npm-@x402/paywall@v2.26.0
npm-@x402/paywall@v2.27.0
npm-@x402/paywall@v2.28.0
npm-@x402/stellar@v2.*
npm-@x402/stellar@v2.19.0
npm-@x402/stellar@v2.20.0
npm-@x402/stellar@v2.21.0
npm-@x402/stellar@v2.22.0
npm-@x402/stellar@v2.23.0
npm-@x402/stellar@v2.24.0
npm-@x402/stellar@v2.25.0
npm-@x402/stellar@v2.26.0
npm-@x402/stellar@v2.27.0
npm-@x402/stellar@v2.28.0
npm-@x402/svm@v2.*
npm-@x402/svm@v2.19.0
npm-@x402/svm@v2.20.0
npm-@x402/svm@v2.21.0
npm-@x402/svm@v2.22.0
npm-@x402/svm@v2.23.0
npm-@x402/svm@v2.24.0
npm-@x402/svm@v2.25.0
npm-@x402/svm@v2.26.0
npm-@x402/svm@v2.27.0
npm-@x402/svm@v2.28.0
npm-@x402/tvm@v2.*
npm-@x402/tvm@v2.19.0
npm-@x402/tvm@v2.20.0
npm-@x402/tvm@v2.21.0
npm-@x402/tvm@v2.22.0
npm-@x402/tvm@v2.23.0
npm-@x402/tvm@v2.24.0
npm-@x402/tvm@v2.25.0
npm-@x402/tvm@v2.26.0
npm-@x402/tvm@v2.27.0
npm-@x402/tvm@v2.28.0
npm-@x402/xrpl@v2.*
npm-@x402/xrpl@v2.19.0
npm-@x402/xrpl@v2.20.0
npm-@x402/xrpl@v2.21.0
npm-@x402/xrpl@v2.22.0
npm-@x402/xrpl@v2.23.0
npm-@x402/xrpl@v2.24.0
npm-@x402/xrpl@v2.25.0
npm-@x402/xrpl@v2.26.0
npm-@x402/xrpl@v2.27.0
npm-@x402/xrpl@v2.28.0
pypi-x402@v2.*
pypi-x402@v2.16.0
pypi-x402@v2.17.0
pypi-x402@v2.18.0
pypi-x402@v2.19.0
pypi-x402@v2.20.0
pypi-x402@v2.21.0
pypi-x402@v2.22.0
pypi-x402@v2.23.0
pypi-x402@v2.24.0
pypi-x402@v2.25.0