x402 SIWX Extension CVE-2026-113603

Exploitation requires that the x402 SIWX (Sign-In-With-X) server extension be enabled and that at least two SIWX-protected routes with differing prices exist (a cheap route and an expensive route). The attacker must be a genuine paying client who completes a real payment for the cheapest route and holds a valid SIGN-IN-WITH-X session, then supplies a mismatched PaymentPayload.resource.url pointing at the expensive route. Limiting factors that reduce real-world risk: the attack only affects routes guarded by this specific extension, it requires a legitimate authenticated SIWX session plus an initial payment (so it is not truly anonymous despite the CVSS PR:N), and it is confined to vulnerable versions - @x402/extensions 2.3.1 through 2.28.0, x402 PyPI 2.11.0 through 2.25.0, and the Go module 2.16.0 through 2.28.0.

This is a moderate-severity authorization/payment bypass (CVSS 4.0 base 6.9, Medium) rather than a critical infrastructure flaw. The vendor vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity exploitation with no user interaction, but impact is deliberately scoped to Low confidentiality and Low integrity with no availability impact (VC:L/VI:L/VA:N) - consistent with unauthorized access to paid content and revenue loss, not code execution or data compromise. A key signal conflict must be flagged: the vector asserts PR:N (unauthenticated), yet the description makes clear the attacker must already be a legitimate PAYING client who completes a genuine payment for the cheapest SIWX route and presents a valid SIGN-IN-WITH-X header - this is effectively an authenticated, economically-gated abuse, so PR:N overstates ease of mass exploitation. No EPSS score, KEV listing, or public exploit was provided in the input, so there is no evidence of active or widespread exploitation; the realistic threat model is targeted abuse by paying customers of a specific x402-monetized API rather than opportunistic internet-wide attacks. A vendor patch (PR #3840) is available and the root cause is confirmed by source diff, so this is a patch-now item for the small population actually running the affected SIWX extension, but it is not a high-urgency emergency for the broader ecosystem.

An attacker who is a paying client of an x402 SIWX-protected API pays once for the cheapest protected route while setting PaymentPayload.resource.url to point at an expensive premium route. Because settlement is incorrectly recorded against the client-supplied resource URL rather than the actual server request path, the server treats the premium route as paid, letting the attacker repeatedly access it using only a replayed SIGN-IN-WITH-X header without any further payment. No public weaponized exploit was identified, though the vendor fix ships a regression test demonstrating the flow.