CVE-2026-113603 x402 @x402/extensions 2.3.1 through 2.28.0 SIWX Payment Bypass via PaymentPayload.resource
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-113603?
CVE-2026-113603 is a medium-severity vulnerability in x402-foundation @x402/extensions, published on 20 Oct 2026.
Official description
The x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28.0, x402 PyPI 2.11.0 through 2.25.0, and Go module 2.16.0 through 2.28.0 contains an authorization bypass vulnerability that allows paying clients to unlock unpaid routes by supplying a mismatched PaymentPayload.resource URL. Attackers can pay for the cheapest SIWX-protected route while setting resource.url to an expensive route, then repeatedly access it using only a SIGN-IN-WITH-X header without further payment.
Weakness: CWE-639
Which versions are affected by CVE-2026-113603?
How do I fix CVE-2026-113603?
No fix has been published for CVE-2026-113603 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-113603 being exploited?
There is no known exploitation of CVE-2026-113603 in the wild and no public exploit code.
Sources
Also known as GHSA-vxw2-vmfp-vrg3.