CVE-2026-113603

The x402 SIWX server extension contains an authorization bypass vulnerability in @x402/extensions (versions 2.3.1 through 2.28.0), x402 PyPI (versions 2.11.0 through 2.25.0), and the Go module (versions 2.16.0 through 2.28.0). The root cause allows paying clients to unlock unpaid routes by provid...

CVE-2026-113603 x402 @x402/extensions 2.3.1 through 2.28.0 SIWX Payment Bypass via PaymentPayload.resource

The x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28.0, x402 PyPI 2.11.0 through 2.25.0, and Go module 2.16.0 through 2.28.0 contains an authorization bypass vulnerability that allows paying clients to unlock unpaid routes by supplying a mismatched PaymentPayload.resource URL...