CVE-2026-113603

The x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28.0, x402 PyPI 2.11.0 through 2.25.0, and Go module 2.16.0 through 2.28.0 contains an authorization bypass vulnerability that allows paying clients to unlock unpaid routes by supplying a mismatched PaymentPayload.resource URL...

CVE-2026-113603 x402 @x402/extensions 2.3.1 through 2.28.0 SIWX Payment Bypass via PaymentPayload.resource

The x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28.0, x402 PyPI 2.11.0 through 2.25.0, and Go module 2.16.0 through 2.28.0 contains an authorization bypass vulnerability that allows paying clients to unlock unpaid routes by supplying a mismatched PaymentPayload.resource URL...

EUVD-2026-105169

The x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28.0, x402 PyPI 2.11.0 through 2.25.0, and Go module 2.16.0 through 2.28.0 contains an authorization bypass vulnerability that allows paying clients to unlock unpaid routes by supplying a mismatched PaymentPayload.resource URL...

CVE-2026-113603

The x402 SIWX server extension contains an authorization bypass vulnerability in @x402/extensions (versions 2.3.1 through 2.28.0), x402 PyPI (versions 2.11.0 through 2.25.0), and the Go module (versions 2.16.0 through 2.28.0). The root cause allows paying clients to unlock unpaid routes by provid...

Free-Riding in the AI Economy: Demystifying Logic Flaws in X402-Enabled Payment Systems

The agentic economy demands programmatic financial rails, positioning the x402 protocol as the de facto standard for machine-to-machine payments. However, bridging synchronous HTTP requests with asynchronous blockchain finality introduces profound state synchronization challenges. In this work, w...

Five Attacks on X402 Agentic Payment Protocol

The x402 protocol revives the HTTP 402 Payment Required status code to enable web-native micropayments across APIs, content, and agents. It combines synchronous HTTP authorization with asynchronous blockchain settlement and introduces a cross-layer attack surface absent from conventional web and...

GO-2026-4647 x402 SDK Security Advisory in github.com/coinbase/x402/go

x402 SDK Security Advisory in github.com/coinbase/x402/go. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an edit to...

@aimo.network/svm (>=1.0.0, <=1.8.0), @andesmountain/x402-request (>=1.0.0, <=1.0.3) +9 more potentially affected by unknown CVE via @x402/svm (>=2.0.0, <=2.5.0)

@x402/svm NPM version =2.0.0, =1.0.0, =1.0.0, =0.1.0, =4.0.0, =0.12.7, =0.2.0, =0.2.3 Source cves: unknown CVE Source advisory: SNYK:JS-X402SVM-15440550...

@aimo.network/svm (>=1.0.0, <=1.8.0), @andesmountain/x402-request (>=1.0.0, <=1.0.3) +9 more potentially affected by unknown CVE via @x402/svm (>=2.0.0, <=2.5.0)

@x402/svm NPM version =2.0.0, =1.0.0, =1.0.0, =0.1.0, =4.0.0, =0.12.7, =0.2.0, =0.2.3 Source cves: unknown CVE Source advisory: GHSA-QR2G-P6Q7-W82M...

Improper Authentication

Overview x402 is a x402: An internet native payments protocol Affected versions of this package are vulnerable to Improper Authentication in facilitator payment processing on Solana. An attacker can interfere with or manipulate payment transactions by exploiting a race condition. Remediation...

x402 SDK Security Advisory

Impact A security vulnerability exists in outdated versions of the x402 SDK. This vulnerability does not affect users' private keys, smart contracts, or funds. The issue impacts resource servers accepting payments on Solana when the facilitator is running a vulnerable version of the x402 SDK. Who...

Improper Authentication

Overview @x402/svm is a x402 Payment Protocol SVM Implementation Affected versions of this package are vulnerable to Improper Authentication in facilitator payment processing on Solana. An attacker can interfere with or manipulate payment transactions by exploiting a race condition. Remediation...

GHSA-QR2G-P6Q7-W82M x402 SDK Security Advisory

Impact A security vulnerability exists in outdated versions of the x402 SDK. This vulnerability does not affect users' private keys, smart contracts, or funds. The issue impacts resource servers accepting payments on Solana when the facilitator is running a vulnerable version of the x402 SDK. Who...

ampersend-sdk (>=0.0.16, <=0.0.28) potentially affected by unknown CVE via x402 (0.3.0)

x402 PYPI version 0.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on x402 and may be impacted: - ampersend-sdk =0.0.16, =0.0.28 Source cves: unknown CVE Source advisory: OSV:GHSA-QR2G-P6Q7-W82M...

coinbase-agentkit (>=0.7.1, <=0.7.4), zyndai-agent (>=0.2.1, <=0.2.2) potentially affected by unknown CVE via x402 (1.0.0)

x402 PYPI version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on x402 and may be impacted: - coinbase-agentkit =0.7.1, =0.2.1, =0.2.2 Source cves: unknown CVE Source advisory: OSV:GHSA-QR2G-P6Q7-W82M...

bindu (>=2026.6.6, <=2026.20.2), bindu-onboard-cli (>=0.1.0, <=0.1.2) +2 more potentially affected by unknown CVE via x402 (0.2.1)

x402 PYPI version 0.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on x402 and may be impacted: - bindu =2026.6.6, =0.1.0, =0.5.5, =2.8.1, =2.9.1 Source cves: unknown CVE Source advisory: OSV:GHSA-QR2G-P6Q7-W82M...

@aimo.network/svm (>=1.0.0, <=1.8.0), @andesmountain/x402-request (>=1.0.0, <=1.0.3) +9 more potentially affected by unknown CVE via @x402/svm (>=2.0.0, <=2.5.0)

@x402/svm NPM version =2.0.0, =1.0.0, =1.0.0, =0.1.0, =4.0.0, =0.12.7, =0.2.0, =0.2.3 Source cves: unknown CVE Source advisory: OSV:GHSA-QR2G-P6Q7-W82M...

PT-2026-25884

Impact A security vulnerability exists in outdated versions of the x402 SDK. This vulnerability does not affect users' private keys, smart contracts, or funds. The issue impacts resource servers accepting payments on Solana when the facilitator is running a vulnerable version of the x402 SDK. Who...

EUVD-2025-199908

Malicious code in x402-legacy npm...

MAL-2025-191485 Malicious code in x402-legacy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e37b562070e10c7c2cf1ae07233d0e676a9c3808a2425407b709e9d03ab981f8 The package x402-legacy was found to contain malicious code. Source: ghsa-malware e93ea6b10273adfc3bd24ad98240fa9d023af96eb7a7c4a5a2073e881140808f An...