Conditional Free-Access Vulnerability in mppx Payment Method by Insumermodel

CVE-2026-104891

What is CVE-2026-104891?

The mppx-condition-gate package contains a vulnerability that allows an unauthenticated attacker to gain free access to content by manipulating wallet addresses. Prior to version 3.0.0 for mppx-condition-gate and 1.0.4 for mppx-token-gate, the packages accepted client-supplied wallet addresses without proper verification, enabling unauthorized users to receive content that should require payment. This loophole allowed cached access grants to be reused within their cache lifetime. The issue has been rectified in the updated versions, ensuring that authorization checks are only granted when the payer's control over the wallet is established.

References