{"id":"CVE-2026-113603","summary":"x402 @x402/extensions 2.3.1 through 2.28.0 SIWX Payment Bypass via PaymentPayload.resource","details":"The x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28.0, x402 PyPI 2.11.0 through 2.25.0, and Go module 2.16.0 through 2.28.0 contains an authorization bypass vulnerability that allows paying clients to unlock unpaid routes by supplying a mismatched PaymentPayload.resource URL. Attackers can pay for the cheapest SIWX-protected route while setting resource.url to an expensive route, then repeatedly access it using only a SIGN-IN-WITH-X header without further payment.","modified":"2026-10-22T02:30:50.084207780Z","published":"2026-10-20T15:40:30.742Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113603.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-639"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113603.json"},{"type":"PACKAGE","url":"https://github.com/x402-foundation/x402"},{"type":"ARTICLE","url":"https://github.com/x402-foundation/x402/blob/go/v2.28.0/go/extensions/signinwithx/server.go"},{"type":"ARTICLE","url":"https://github.com/x402-foundation/x402/blob/npm-@x402/extensions@v2.28.0/typescript/packages/extensions/src/sign-in-with-x/hooks.ts"},{"type":"ARTICLE","url":"https://github.com/x402-foundation/x402/blob/pypi-x402@v2.25.0/python/x402/extensions/sign_in_with_x/hooks.py"},{"type":"REPORT","url":"https://github.com/x402-foundation/x402/issues/3838"},{"type":"FIX","url":"https://github.com/x402-foundation/x402/pull/3840"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113603"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/x402-x402-extensions-2.3.1-through-2.28.0-siwx-payment-bypass-via-paymentpayload-resource"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/x402-foundation/x402","events":[{"introduced":"dd49a436183aaa72f3a8e2d8b82d8cc226fb6e5e"},{"last_affected":"6b6ee91fee027b540faabcb25774e73851006c3b"},{"introduced":"c03f1a8cb3ff36463b91531dbd0c701ddcdf3ffa"},{"last_affected":"6b6ee91fee027b540faabcb25774e73851006c3b"},{"introduced":"67b1ba0a7abbd7907a28fa624670872532e0eae9"},{"last_affected":"6b6ee91fee027b540faabcb25774e73851006c3b"}],"database_specific":{"extracted_events":[{"strategy":"StandardRange","range":[{"introduced":"2.3.1"},{"last_affected":"2.28.0"}],"source":"AFFECTED_FIELD"},{"strategy":"StandardRange","range":[{"introduced":"2.11.0"},{"last_affected":"2.25.0"}],"source":"AFFECTED_FIELD"},{"strategy":"StandardRange","range":[{"introduced":"2.16.0"},{"last_affected":"2.28.0"}],"source":"AFFECTED_FIELD"}]}}],"versions":["pypi-x402@v2.25.0","npm-@x402/xrpl@v2.28.0","npm-@x402/tvm@v2.28.0","npm-@x402/svm@v2.28.0","npm-@x402/stellar@v2.28.0","npm-@x402/paywall@v2.28.0","npm-@x402/next@v2.28.0","npm-@x402/near@v2.28.0","npm-@x402/mcp@v2.28.0","npm-@x402/keeta@v2.28.0","npm-@x402/hono@v2.28.0","npm-@x402/hedera@v2.28.0","npm-@x402/fetch@v2.28.0","npm-@x402/fastify@v2.28.0","npm-@x402/extensions@v2.28.0","npm-@x402/express@v2.28.0","npm-@x402/evm@v2.28.0","npm-@x402/core@v2.28.0","npm-@x402/concordium@v2.28.0","npm-@x402/casper@v2.28.0","npm-@x402/cardano@v2.28.0","npm-@x402/axios@v2.28.0","npm-@x402/avm@v2.28.0","npm-@x402/aptos@v2.28.0","go/v2.28.0","go-x402@v2.28.0","pypi-x402@v2.24.0","npm-@x402/xrpl@v2.27.0","npm-@x402/tvm@v2.27.0","npm-@x402/svm@v2.27.0","npm-@x402/stellar@v2.27.0","npm-@x402/paywall@v2.27.0","npm-@x402/next@v2.27.0","npm-@x402/near@v2.27.0","npm-@x402/mcp@v2.27.0","npm-@x402/keeta@v2.27.0","npm-@x402/hono@v2.27.0","npm-@x402/hedera@v2.27.0","npm-@x402/fetch@v2.27.0","npm-@x402/fastify@v2.27.0","npm-@x402/extensions@v2.27.0","npm-@x402/express@v2.27.0","npm-@x402/evm@v2.27.0","npm-@x402/core@v2.27.0","npm-@x402/concordium@v2.27.0","npm-@x402/casper@v2.27.0","npm-@x402/cardano@v2.27.0","npm-@x402/axios@v2.27.0","npm-@x402/avm@v2.27.0","npm-@x402/aptos@v2.27.0","go/v2.27.0","go-x402@v2.27.0","pypi-x402@v2.23.0","npm-@x402/xrpl@v2.26.0","npm-@x402/tvm@v2.26.0","npm-@x402/svm@v2.26.0","npm-@x402/stellar@v2.26.0","npm-@x402/paywall@v2.26.0","npm-@x402/next@v2.26.0","npm-@x402/near@v2.26.0","npm-@x402/mcp@v2.26.0","npm-@x402/keeta@v2.26.0","npm-@x402/hono@v2.26.0","npm-@x402/hedera@v2.26.0","npm-@x402/fetch@v2.26.0","npm-@x402/fastify@v2.26.0","npm-@x402/extensions@v2.26.0","npm-@x402/express@v2.26.0","npm-@x402/evm@v2.26.0","npm-@x402/core@v2.26.0","npm-@x402/concordium@v2.26.0","npm-@x402/casper@v2.26.0","npm-@x402/cardano@v2.26.0","npm-@x402/axios@v2.26.0","npm-@x402/avm@v2.26.0","npm-@x402/aptos@v2.26.0","go/v2.26.0","go-x402@v2.26.0","pypi-x402@v2.22.0","npm-@x402/xrpl@v2.25.0","npm-@x402/tvm@v2.25.0","npm-@x402/svm@v2.25.0","npm-@x402/stellar@v2.25.0","npm-@x402/paywall@v2.25.0","npm-@x402/next@v2.25.0","npm-@x402/near@v2.25.0","npm-@x402/mcp@v2.25.0","npm-@x402/keeta@v2.25.0","npm-@x402/hono@v2.25.0","npm-@x402/hedera@v2.25.0","npm-@x402/fetch@v2.25.0","npm-@x402/fastify@v2.25.0","npm-@x402/extensions@v2.25.0","npm-@x402/express@v2.25.0","npm-@x402/evm@v2.25.0","npm-@x402/core@v2.25.0","npm-@x402/concordium@v2.25.0","npm-@x402/axios@v2.25.0","npm-@x402/avm@v2.25.0","npm-@x402/aptos@v2.25.0","go/v2.25.0","go-x402@v2.25.0","pypi-x402@v2.21.0","npm-@x402/xrpl@v2.24.0","npm-@x402/tvm@v2.24.0","npm-@x402/svm@v2.24.0","npm-@x402/stellar@v2.24.0","npm-@x402/paywall@v2.24.0","npm-@x402/next@v2.24.0","npm-@x402/near@v2.24.0","npm-@x402/mcp@v2.24.0","npm-@x402/keeta@v2.24.0","npm-@x402/hono@v2.24.0","npm-@x402/hedera@v2.24.0","npm-@x402/fetch@v2.24.0","npm-@x402/fastify@v2.24.0","npm-@x402/extensions@v2.24.0","npm-@x402/express@v2.24.0","npm-@x402/evm@v2.24.0","npm-@x402/core@v2.24.0","npm-@x402/concordium@v2.24.0","npm-@x402/axios@v2.24.0","npm-@x402/avm@v2.24.0","npm-@x402/aptos@v2.24.0","go/v2.24.0","go-x402@v2.24.0","pypi-x402@v2.20.0","npm-@x402/xrpl@v2.23.0","npm-@x402/tvm@v2.23.0","npm-@x402/svm@v2.23.0","npm-@x402/stellar@v2.23.0","npm-@x402/paywall@v2.23.0","npm-@x402/next@v2.23.0","npm-@x402/near@v2.23.0","npm-@x402/mcp@v2.23.0","npm-@x402/keeta@v2.23.0","npm-@x402/hono@v2.23.0","npm-@x402/hedera@v2.23.0","npm-@x402/fetch@v2.23.0","npm-@x402/fastify@v2.23.0","npm-@x402/extensions@v2.23.0","npm-@x402/express@v2.23.0","npm-@x402/evm@v2.23.0","npm-@x402/core@v2.23.0","npm-@x402/concordium@v2.23.0","npm-@x402/axios@v2.23.0","npm-@x402/avm@v2.23.0","npm-@x402/aptos@v2.23.0","go/v2.23.0","go-x402@v2.23.0","pypi-x402@v2.19.0","npm-@x402/xrpl@v2.22.0","npm-@x402/tvm@v2.22.0","npm-@x402/svm@v2.22.0","npm-@x402/stellar@v2.22.0","npm-@x402/paywall@v2.22.0","npm-@x402/next@v2.22.0","npm-@x402/near@v2.22.0","npm-@x402/mcp@v2.22.0","npm-@x402/keeta@v2.22.0","npm-@x402/hono@v2.22.0","npm-@x402/hedera@v2.22.0","npm-@x402/fetch@v2.22.0","npm-@x402/fastify@v2.22.0","npm-@x402/extensions@v2.22.0","npm-@x402/express@v2.22.0","npm-@x402/evm@v2.22.0","npm-@x402/core@v2.22.0","npm-@x402/concordium@v2.22.0","npm-@x402/axios@v2.22.0","npm-@x402/avm@v2.22.0","npm-@x402/aptos@v2.22.0","go/v2.22.0","go-x402@v2.22.0","pypi-x402@v2.18.0","npm-@x402/xrpl@v2.21.0","npm-@x402/tvm@v2.21.0","npm-@x402/svm@v2.21.0","npm-@x402/stellar@v2.21.0","npm-@x402/paywall@v2.21.0","npm-@x402/next@v2.21.0","npm-@x402/near@v2.21.0","npm-@x402/mcp@v2.21.0","npm-@x402/keeta@v2.21.0","npm-@x402/hono@v2.21.0","npm-@x402/hedera@v2.21.0","npm-@x402/fetch@v2.21.0","npm-@x402/fastify@v2.21.0","npm-@x402/extensions@v2.21.0","npm-@x402/express@v2.21.0","npm-@x402/evm@v2.21.0","npm-@x402/core@v2.21.0","npm-@x402/concordium@v2.21.0","npm-@x402/axios@v2.21.0","npm-@x402/avm@v2.21.0","npm-@x402/aptos@v2.21.0","go/v2.21.0","go-x402@v2.21.0","pypi-x402@v2.17.0","npm-@x402/xrpl@v2.20.0","npm-@x402/tvm@v2.20.0","npm-@x402/svm@v2.20.0","npm-@x402/stellar@v2.20.0","npm-@x402/paywall@v2.20.0","npm-@x402/next@v2.20.0","npm-@x402/near@v2.20.0","npm-@x402/mcp@v2.20.0","npm-@x402/keeta@v2.20.0","npm-@x402/hono@v2.20.0","npm-@x402/hedera@v2.20.0","npm-@x402/fetch@v2.20.0","npm-@x402/fastify@v2.20.0","npm-@x402/extensions@v2.20.0","npm-@x402/express@v2.20.0","npm-@x402/evm@v2.20.0","npm-@x402/core@v2.20.0","npm-@x402/concordium@v2.20.0","npm-@x402/axios@v2.20.0","npm-@x402/avm@v2.20.0","npm-@x402/aptos@v2.20.0","go/v2.20.0","go-x402@v2.20.0","pypi-x402@v2.16.0","npm-@x402/xrpl@v2.19.0","npm-@x402/tvm@v2.19.0","npm-@x402/svm@v2.19.0","npm-@x402/stellar@v2.19.0","npm-@x402/paywall@v2.19.0","npm-@x402/next@v2.19.0","npm-@x402/near@v2.19.0","npm-@x402/mcp@v2.19.0","npm-@x402/keeta@v2.19.0","npm-@x402/hono@v2.19.0","npm-@x402/hedera@v2.19.0","npm-@x402/fetch@v2.19.0","npm-@x402/fastify@v2.19.0","npm-@x402/extensions@v2.19.0","npm-@x402/express@v2.19.0","npm-@x402/evm@v2.19.0","npm-@x402/core@v2.19.0","npm-@x402/concordium@v2.19.0","npm-@x402/axios@v2.19.0","npm-@x402/avm@v2.19.0","npm-@x402/aptos@v2.19.0","go/v2.19.0","go-x402@v2.19.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-113603.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}]}