CVE-2026-113603: Authorization Bypass Through User-Controlled Key in x402-foundation @x402/extensions

The x402 SIWX server extension in @x402/extensions versions 2.3.1 through 2.28.0, x402 PyPI versions 2.11.0 through 2.25.0, and Go module versions 2.16.0 through 2.28.0 contains an authorization bypass vulnerability. This flaw allows an attacker who pays for the cheapest SIWX-protected route to supply a mismatched PaymentPayload.resource URL pointing to a more expensive route. The attacker can then repeatedly access the expensive route using only a SIGN-IN-WITH-X header without making additional payments, effectively bypassing authorization controls.

Attackers can exploit this vulnerability to access paid routes without paying the correct amount, potentially causing revenue loss and unauthorized access to premium resources. The vulnerability does not require privileges or user interaction beyond initial payment and header manipulation. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access controls and monitor for unusual usage patterns related to SIWX-protected routes. Avoid relying solely on the PaymentPayload.resource URL for authorization decisions.