CVE-2026-113603

Name of the Vulnerable Software and Affected Versions @x402/extensions versions 2.3.1 through 2.28.0 x402 PyPI versions 2.11.0 through 2.25.0 x402 Go module versions 2.16.0 through 2.28.0

Description An authorization bypass exists in the SIWX server extension. Paying clients can unlock unpaid routes by providing a mismatched PaymentPayload.resource URL. This allows an attacker to pay for the least expensive SIWX-protected route while specifying a high-cost route in the resource.url variable, enabling repeated access to the expensive route using only a SIGN-IN-WITH-X header without additional payment.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.