CVE-2026-113603 x402-foundation CVE debrief

Who should care

Defenders responsible for systems using @x402/extensions, especially those managing payment or access control systems, should assess exposure and prioritize remediation. They should verify if their systems are using vulnerable versions of @x402/extensions and prioritize patching or mitigating the vulnerability. Defenders should also monitor for unusual payment patterns or unauthorized access attempts and review compensating controls for exposed systems.

Why it matters

CVE-2026-113603 is a medium-severity vulnerability in @x402/extensions that allows authorization bypass, potentially enabling attackers to access paid routes without payment. Defenders should verify exposure, prioritize remediation, and monitor systems for unusual activity.

• Defenders need to verify if their systems are using vulnerable versions of @x402/extensions and prioritize patching or mitigating the vulnerability.
• Successful exploitation could allow unauthorized access to paid routes without proper payment.
• Defenders should monitor for unusual payment patterns or unauthorized access attempts.
• Remediation priority is medium due to the potential for unauthorized access.

Technical summary

The x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28.0, x402 PyPI 2.11.0 through 2.25.0, and Go module 2.16.0 through 2.28.0 contains an authorization bypass vulnerability. This vulnerability allows paying clients to unlock unpaid routes by supplying a mismatched PaymentPayload.resource URL. Attackers can exploit this by paying for the cheapest SIWX-protected route while setting resource.url to an expensive route, then repeatedly access it using only a SIGN-IN-WITH-X header without further payment. Defenders should prioritize verifying the presence of this vulnerability in their systems, especially if they use @x402/extensions versions between 2.3.1 and 2.28.0, and implement patches or workarou

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their systems, especially if they use @x402/extensions versions between 2.3.1 and 2.28.0, and implement patches or workarounds as available.

Recommended defensive actions

• Verify the presence of @x402/extensions in your systems and check if versions are between 2.3.1 and 2.28.0.
• Review and implement patches or workarounds as available from the vendor.
• Monitor systems for unusual payment patterns or unauthorized access attempts.
• Update inventory records to reflect accurate version information.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to technical descriptions and patches. Defenders should verify the presence of vulnerable versions in their systems, review official advisories for patches or workarounds, and monitor for unusual payment patterns or unauthorized access attempts. The vulnerability affects @x402/extensions 2.3.1 through 2.28.0, x402 PyPI 2.11.0 through 2.25.0, and Go module 2.16.0 through 2.28.0.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.