Mppx Token Gate
Monthly
An authentication bypass in the npm packages @insumermodel/mppx-condition-gate (before 3.0.0) and @insumermodel/mppx-token-gate (1.0.0 through 1.0.3) lets unauthenticated remote attackers obtain content that should require payment by simply naming any wallet address that satisfies the configured on-chain condition. The gates trusted the client-supplied credential.source as proof of payer identity instead of verifying wallet control, so since qualifying wallets are public blockchain state, no secret or wallet ownership is needed; cached free-access grants can also be reused for the configured cache lifetime. No public exploit code was identified at time of analysis, and practical risk is bounded by the small deployment footprint of these packages; the vendor-released fixes are @insumermodel/mppx-condition-gate 3.0.0 and @insumermodel/mppx-token-gate 1.0.4.
An authentication bypass in the npm packages @insumermodel/mppx-condition-gate (before 3.0.0) and @insumermodel/mppx-token-gate (1.0.0 through 1.0.3) lets unauthenticated remote attackers obtain content that should require payment by simply naming any wallet address that satisfies the configured on-chain condition. The gates trusted the client-supplied credential.source as proof of payer identity instead of verifying wallet control, so since qualifying wallets are public blockchain state, no secret or wallet ownership is needed; cached free-access grants can also be reused for the configured cache lifetime. No public exploit code was identified at time of analysis, and practical risk is bounded by the small deployment footprint of these packages; the vendor-released fixes are @insumermodel/mppx-condition-gate 3.0.0 and @insumermodel/mppx-token-gate 1.0.4.