62 matches found
EUVD-2026-92447
mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control...
GHSA-JG6Q-3QFH-R9F8 mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control
Impact Both packages wrap an mppx payment method so that a wallet meeting on-chain conditions is granted free access instead of being charged. The free-access path reads the payer address from credential.source — a client-supplied DID in the payment credential — asks InsumerAPI whether that addre...
mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control
Impact Both packages wrap an mppx payment method so that a wallet meeting on-chain conditions is granted free access instead of being charged. The free-access path reads the payer address from credential.source — a client-supplied DID in the payment credential — asks InsumerAPI whether that addre...
CVE-2026-104891
mppx-condition-gate provides conditional free-access wrappers for mppx payment methods. Prior to @insumermodel/mppx-condition-gate 3.0.0 and @insumermodel/mppx-token-gate 1.0.4, the packages read a wallet address from the client-supplied credential.source, checked whether that public address met...
CVE-2026-104891 mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control
mppx-condition-gate provides conditional free-access wrappers for mppx payment methods. Prior to @insumermodel/mppx-condition-gate 3.0.0 and @insumermodel/mppx-token-gate 1.0.4, the packages read a wallet address from the client-supplied credential.source, checked whether that public address met...
CVE-2026-104891
The @insumermodel/mppx-condition-gate and @insumermodel/mppx-token-gate packages are vulnerable to an authentication bypass where the software grants free-access receipts based on a wallet address provided in the client-supplied credential.source. The underlying cause is that the system fails to ...
CVE-2026-104891 mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control
mppx-condition-gate provides conditional free-access wrappers for mppx payment methods. Prior to @insumermodel/mppx-condition-gate 3.0.0 and @insumermodel/mppx-token-gate 1.0.4, the packages read a wallet address from the client-supplied credential.source, checked whether that public address met...
CVE-2026-104891 mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control
mppx-condition-gate provides conditional free-access wrappers for mppx payment methods. Prior to @insumermodel/mppx-condition-gate 3.0.0 and @insumermodel/mppx-token-gate 1.0.4, the packages read a wallet address from the client-supplied credential.source, checked whether that public address met...
CVE-2026-104891: Authentication Bypass by Spoofing
mppx-condition-gate provides conditional free-access wrappers for mppx payment methods. Prior to @insumermodel/mppx-condition-gate 3.0.0 and @insumermodel/mppx-token-gate 1.0.4, the packages read a wallet address from the client-supplied credential.source, checked whether that public address met...
PT-2026-106014
Name of the Vulnerable Software and Affected Versions @insumermodel/mppx-condition-gate versions prior to 3.0.0 @insumermodel/mppx-token-gate versions prior to 1.0.4 Description These packages provide conditional free-access wrappers for mppx payment methods. The issue occurs when the software...
CVE-2026-63627
creationtimestamp| type| source ---|---|--- 2026-09-22 22:36:28+00:00| published-proof-of-concept| https://github.com/wevm/mppx/security/advisories/GHSA-727h-3vm5-qwq6...
CVE-2026-63628
creationtimestamp| type| source ---|---|--- 2026-09-22 22:36:26+00:00| published-proof-of-concept| https://github.com/wevm/mppx/security/advisories/GHSA-vc9j-9wph-qghj...
mppx: Gas Draining with access list
Details When the server acts as the feepayer, mppx 0.6.27 copies the client-supplied EIP-2930 access list verbatim into the cosigned fee-payer transaction. The TypeScript SDK's fee-payer cosigning path accepts any accesslist the client includes in the 0x78 FeePayerEnvelope without inspecting its...
NPM: mppx: Gas Draining with access list
NPM: mppx: Gas Draining with access list vulnerability discovered by ? in WordPress Npm mppx versions 0.8.2...
GHSA-VC9J-9WPH-QGHJ mppx: Gas Draining with access list
Details When the server acts as the feepayer, mppx 0.6.27 copies the client-supplied EIP-2930 access list verbatim into the cosigned fee-payer transaction. The TypeScript SDK's fee-payer cosigning path accepts any accesslist the client includes in the 0x78 FeePayerEnvelope without inspecting its...
@0xsquid/mpp (>=0.1.1-beta.1, <=0.2.0), @agent-score/pay (>=0.1.0-rc.4, <=0.2.6) +171 more potentially affected by CVE-2026-63628 via mppx (>=0.1.1, <=0.7.0)
mppx NPM version =0.1.1, =0.1.1-beta.1, =0.1.0-rc.4, =0.0.1, =0.0.0-pr-246-20260515203519, =0.1.0, =0.1.0, =0.1.2, =0.1.1, =0.1.1, =0.1.0, =1.0.11, =1.0.0, =1.0.0, =2.4.0 and more Source cves: CVE-2026-63628 Source advisory: GHSA-VC9J-9WPH-QGHJ...
@0xsquid/mpp (>=0.1.1-beta.1, <=0.2.0), @agent-score/pay (>=0.1.0-rc.4, <=0.2.6) +171 more potentially affected by CVE-2026-63628 via mppx (>=0.1.1, <=0.7.0)
mppx NPM version =0.1.1, =0.1.1-beta.1, =0.1.0-rc.4, =0.0.1, =0.0.0-pr-246-20260515203519, =0.1.0, =0.1.0, =0.1.2, =0.1.1, =0.1.1, =0.1.0, =1.0.11, =1.0.0, =1.0.0, =2.4.0 and more Source cves: CVE-2026-63628 Source advisory: OSV:GHSA-VC9J-9WPH-QGHJ...
GHSA-727H-3VM5-QWQ6 mppx: Gas Draining with padding
Details When the server acts as the feepayer, mppx 0.6.27 validates calldata using viem's decodeFunctionData, which is lenient about trailing bytes. The FeePayerPolicy caps gaslimit ≤ 2 M and maxfeepergas ≤ 100 Gwei but does not check calldata length. Tempo uses legacy calldata gas pricing: 16 ga...
mppx: Gas Draining with padding
Details When the server acts as the feepayer, mppx 0.6.27 validates calldata using viem's decodeFunctionData, which is lenient about trailing bytes. The FeePayerPolicy caps gaslimit ≤ 2 M and maxfeepergas ≤ 100 Gwei but does not check calldata length. Tempo uses legacy calldata gas pricing: 16 ga...