CVE-2026-113603

The x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28.0, x402 PyPI 2.11.0 through 2.25.0, and Go module 2.16.0 through 2.28.0 contains an authorization bypass vulnerability that allows paying clients to unlock unpaid routes by supplying a mismatched PaymentPayload.resource URL. Attackers can pay for the cheapest SIWX-protected route while setting resource.url to an expensive route, then repeatedly access it using only a SIGN-IN-WITH-X header without further payment.

CVSS 4.0

6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS

0.4% chance of exploitation in the next 30 days; higher than 28% of CVEs (scores of 2026-10-25)

CWE

CWE-639

Published

2026-10-20

Modified

2026-10-21

Record from

the NVD, synced 2026-10-22

References

• https://github.com/x402-foundation/x402/blob/go/v2.28.0/go/extensions/signinwithx/server.go
• https://github.com/x402-foundation/x402/blob/npm-@x402/extensions@v2.28.0/typescript/packages/extensions/src/sign-in-with-x/hooks.ts
• https://github.com/x402-foundation/x402/blob/pypi-x402@v2.25.0/python/x402/extensions/sign_in_with_x/hooks.py
• https://github.com/x402-foundation/x402/issues/3838
• https://github.com/x402-foundation/x402/pull/3840

Check your stackJSON