mppx-condition-gate CVE-2026-104891

Exploitable only where a vulnerable version is deployed and actively using the free-access path: @insumermodel/mppx-condition-gate before 3.0.0, or @insumermodel/mppx-token-gate 1.0.0 through 1.0.3, configured with on-chain conditions to grant free access to otherwise-paid content. The attacker must name a wallet address that actually satisfies the configured condition (token balance or NFT ownership), but since qualifying wallets are public blockchain state this is a lookup, not a secret. No authentication, user interaction, or control of the named wallet is required (PR:N, UI:N), and default condition-gating configurations are affected. The primary limiting factor is scope of deployment, not exploit prerequisites; upgrading to the fixed versions, which require a provenPayer resolver and fall through to payment when control is unproven, eliminates the condition.

This is a genuine access-control bypass (CWE-290, Authentication Bypass by Spoofing) rather than a high-CVSS-but-low-real-risk issue, but its practical priority is tightly bounded by the affected software's tiny footprint. The signals are internally consistent: the NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) matches the description - a remote, unauthenticated caller supplies credential.source and receives a free-access receipt with no proof of wallet control, and the qualifying wallets are public on-chain state, so there is nothing to brute-force or guess. The exploit is therefore trivially reliable where the vulnerable gate is deployed. However, no EPSS score, KEV listing, or public POC was provided in the intelligence; there is no public exploit identified at time of analysis and no evidence of active exploitation. The dominant risk-limiting factor is NOT exploit difficulty but deployment scarcity: these are obscure, now-deprecated npm packages for mppx crypto payment gating. Note the confidentiality-only scoring (C:H/I:N/A:N) is defensible since the impact is unauthorized access to paid content, though one could also frame payment-bypass as an integrity/business-logic concern - the vendor fix confirms the access-control reading.

An attacker browsing a site that uses mppx-condition-gate (<3.0.0) or mppx-token-gate (<1.0.4) for paywalled content looks up any wallet that already satisfies the configured on-chain condition (e.g., holds the required token or NFT) - public chain data - and sends a request whose credential.source names that wallet. The gate confirms the address meets the condition and returns a free-access receipt without ever invoking the wrapped payment verifier or proving the caller controls the wallet, so the attacker receives the paid content for free, and the cached grant can be replayed for the configured cache lifetime. No public exploit code was identified, but exploitation is low-complexity and requires no authentication.