Threats tagged 'ghsa-jg6q-3qfh-r9f8'

CVE-2026-104891 is an authentication bypass vulnerability in the douglasborthwick-crypto mppx-condition-gate packages. These packages improperly grant free access to payment routes by trusting a client-supplied wallet address without verifying control over that wallet. This allows attackers to name any qualifying wallet address and bypass payment. All published versions of both packages are affected. Fixed versions will require proof of wallet control before granting free access. Until patched, removing the condition gate or ensuring prior wallet binding is recommended.