Authorization Bypass Vulnerability in x402 SIWX Server Extension from x402

CVE-2026-113603

What is CVE-2026-113603?

The x402 SIWX server extension harbors an authorization bypass vulnerability enabling unauthorized access to paid routes. Attackers can exploit this flaw by submitting a mismatched PaymentPayload.resource URL, allowing them to unlock premium features without the requisite payment. Specifically, they can purchase the least expensive route while directing the resource URL to a more costly route, subsequently gaining repeated access without further payment through the use of a SIGN-IN-WITH-X header.

References