x402-foundation CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM x402-foundation CVE published 2026-10-20

CVE-2026-113603

The x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28.0 contains an authorization bypass vulnerability. This vulnerability allows paying clients to unlock unpaid routes by supplying a mismatched PaymentPayload.resource URL. Attackers can exploit this by paying for the cheapest SIWX-protected route while setting resource.url to an expensive route, then repeatedly access it using only a SIGN [truncated]