GCVE - cpe:2.3:a:x402-foundation:github.com/x402-foundation/x402/go/v2:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:x402-foundation:github.com/x402-foundation/x402/go/v2:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	X402 Foundation (`f31bff01-211a-5f3d-be7f-533ecb9e6d6c`)
Product	Github.Com/X402 Foundation/X402/Go/V2 (`6494baf6-7f9d-5ab7-a1fc-e262e20f49f0`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-113603`	vulnerable	2026-11-03 10:16:27.993044	x402 @x402/extensions 2.3.1 through 2.28.0 SIWX Payment Bypass via PaymentPayload.resource MEDIUM (6.5) The x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28.0, x402 PyPI 2.11.0 through 2.25.0, and Go module 2.16.0 through 2.28.0 contains an authorization bypass vulnerability that allows paying clients to unlock unpaid routes by supplying a mismatched PaymentPayload.resource URL. Attackers can pay for the cheapest SIWX-protected route while setting resource.url to an expensive route, then repeatedly access it using only a SIGN-IN-WITH-X header without further payment. Published: 2026-10-20T15:40:30.742Z Updated: 2026-10-21T15:54:28.895Z Open on db.gcve.eu Reference links https://github.com/x402-foundation/x402/issues/3838 https://github.com/x402-foundation/x402/pull/3840 https://github.com/x402-foundation/x402/blob/npm-@x402/extensions@v2.28.0/typescript/packages/extensions/src/sign-in-with-x/hooks.ts https://github.com/x402-foundation/x402/blob/pypi-x402@v2.25.0/python/x402/extensions/sign_in_with_x/hooks.py https://github.com/x402-foundation/x402/blob/go/v2.28.0/go/extensions/signinwithx/server.go	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.