Authorization Bypass in x402 SIWX Server Extension

Executive Summary

CVE-2026-113603 is an authorization bypass vulnerability in the x402 SIWX server extension. It allows attackers to pay for the cheapest SIWX-protected route while setting the resource URL to an expensive route. After this initial payment, the attacker can repeatedly access the expensive route using only a SIGN-IN-WITH-X header without further payment, bypassing authorization checks.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect SIWX-protected routes for mismatched PaymentPayload.resource URLs. Check server logs for repeated access to expensive routes using only a SIGN-IN-WITH-X header without additional payments. Review payment settlement hooks in TypeScript, Python, or Go codebases to verify if they record client-supplied URLs instead of server-processed paths.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthorized access to paid resources without proper payment. Attackers can exploit it to access expensive routes or services without paying the required fee, potentially leading to financial losses for service providers. It undermines the integrity of the payment and access control system.

Useful 0 Not Useful 0

Mitigation Strategies

Update to patched versions of @x402/extensions (>=2.28.1), x402 PyPI (>=2.25.1), and Go module (>=2.28.1). Modify payment settlement hooks to record the server's HTTP request path instead of client-supplied URLs. Ensure the settle hook uses ctx.transportContext.request.path for verification.

Useful 0 Not Useful 0