X402
Monthly
Payment bypass in the x402 Sign-In-With-X (SIWX) server extension lets a client that has paid for one cheap protected route unlock a more expensive route by supplying a mismatched PaymentPayload.resource URL and then reusing only its SIGN-IN-WITH-X header for repeat access. The flaw spans three implementations of the same extension - the npm package @x402/extensions 2.3.1 through 2.28.0, the x402 PyPI package 2.11.0 through 2.25.0, and the Go module github.com/x402-foundation/x402/go/v2 2.16.0 through 2.28.0 - and only manifests when at least two SIWX-protected routes exist at different price points. Exploitation is not anonymous: the attacker must complete a genuine payment for the cheapest route and hold a valid SIWX session, and no public exploit code or confirmed active exploitation was identified at time of analysis; an upstream fix exists in pull request #3840.
Payment bypass in the x402 Sign-In-With-X (SIWX) server extension lets a client that has paid for one cheap protected route unlock a more expensive route by supplying a mismatched PaymentPayload.resource URL and then reusing only its SIGN-IN-WITH-X header for repeat access. The flaw spans three implementations of the same extension - the npm package @x402/extensions 2.3.1 through 2.28.0, the x402 PyPI package 2.11.0 through 2.25.0, and the Go module github.com/x402-foundation/x402/go/v2 2.16.0 through 2.28.0 - and only manifests when at least two SIWX-protected routes exist at different price points. Exploitation is not anonymous: the attacker must complete a genuine payment for the cheapest route and hold a valid SIWX session, and no public exploit code or confirmed active exploitation was identified at time of analysis; an upstream fix exists in pull request #3840.