Skip to content
AI Security Wire

Published

- 5 min read

By

x402 Agent Payment SDK: 25 Flaws Disclosed, 3 Critical Fixed Without Advisory

agentic-ai x402 supply-chain agent-payments vulnerability-disclosure
img of x402 Agent Payment SDK: 25 Flaws Disclosed, 3 Critical Fixed Without Advisory

Security firm V12 disclosed 25 vulnerabilities in the x402 agent payment protocol on 22 October 2026, three of them critical. The critical fixes shipped in August. The project did not publish a security advisory for them, so advisory-based dependency scanners report nothing. The other 22 findings have no public detail, and V12 gives no fix status for them. CSA writes that neither V12 nor the Foundation has reported exploitation, citing The Hacker News, which we could not open.

What x402 is

x402 is an open protocol that lets software agents pay for web resources. A server answers a request with an HTTP 402 response listing acceptable payments, and the client library signs a payment authorisation and retries. The reference SDKs are published in TypeScript, Python and Go under the x402-foundation GitHub organisation. Agents that browse paid APIs often hold a funded wallet and sign automatically, which makes the client library the security boundary.

The three critical findings

All three descriptions come from V12’s post (22 October). V12 says its tests were local and that it did not submit a live transaction for the Solana case.

  1. No default spending limit. The documented default client had no per-payment or total budget and picked the first payment option the server offered. A hostile server could request a compatible token’s full balance. V12 says an earlier small payment could reveal the wallet address so the server could check the balance first.
  2. Solana payment bypass. The TypeScript Solana facilitators decoded the third instruction as a TransferChecked without checking its type. ApproveChecked differs only in its first byte. V12 says verification returned valid for an approval, so a merchant could deliver a paid resource and receive no tokens.
  3. Cross-site login signing. The Sign-In-With-X (SIWx) extension signed login challenges from a 402 response without checking that the domain and URI matched the site contacted. A challenge from one site could be relayed to another for session takeover.

Timeline and the missing advisory

V12 reported the 3 critical and 13 high-severity findings on 12 August and the 9 medium and low findings on 9 September. V12 says the critical issues were fixed by 20 August. It gives no fix status for the other 22.

CSA, in a research note dated 26 October, reviewed the repository and found fix pull requests merged between 12 and 18 August (merge dates, not release dates). One spend-controls PR was opened on 11 August, a day before V12’s reported submission date. It says the spend-controls pull request was titled “feat(TS): spend controls” with no mention of a vulnerability, and that the changelog listed 2.23.0 under “Minor Changes”. CSA also reports that the project’s SECURITY.md asks for private reports through Slack, says a bug bounty is “coming soon”, and does not commit to advisories or CVEs. We read SECURITY.md ourselves and it matches that description.

One related CVE exists, separate from the three critical issues: CVE-2026-113603, a medium-severity authorisation bypass in the SIWx server path, assigned by VulnCheck on 20 October. NVD lists it as “Awaiting Analysis”. Its CVSS 4.0 score of 6.9 is a CNA-secondary score from VulnCheck, with no NVD-primary score. We checked as of 2 November: it is absent from the CISA KEV feed dated 30 October. Affected ranges are @x402/extensions 2.3.1 through 2.28.0, Python 2.11.0 through 2.25.0 and Go 2.16.0 through 2.28.0. The GitHub advisory entry, GHSA-vxw2-vmfp-vrg3, is unreviewed and maps to no package, so npm audit and Dependabot do not flag it. The fix pull request (#3840) was still open and unmerged on 2 November, and we found no confirmed fixed release (@x402/extensions 2.29.0, published 28 October, and PyPI x402 2.26.0 were the latest on 2 November; no source says either fixes it). For the August fixes, no advisory exists at all.

One reversal risk from CSA: setting spendControls: false removes the cap and reintroduces the first critical issue.

What to do

Our assessment: advisory silence is missing information, not a sign of safety. For the August fixes, version comparison is the only reliable check.

  • Inventory x402 packages, including transitive ones, and confirm TypeScript packages are at 2.23.0 or later and Python and Go clients at August 18 releases or later (versions per CSA). That covers the critical issues only, not CVE-2026-113603.
  • Search code and configuration for spendControls: false and require an owner and a justification for each.
  • Set a maximum payment near the expected price per resource, not a generic ceiling, and check amounts against an operator-controlled quote before signing.
  • Enforce price limits in a signing proxy or policy service the agent cannot reconfigure, and keep agent wallets funded only for the current operating period.
  • If you run SIWx on the server side, review route entitlements, since no fixed release for CVE-2026-113603 is confirmed, and track PR #3840.

V12 sells a commercial security agent, and its post is the only source for the three critical technical descriptions. CSA’s repository history, which we could not independently open, supports the dates and fix timing.

References

Frequently Asked Questions

Is there evidence these flaws were exploited?
No evidence found as of 2 November 2026 in the V12 post, the Cloud Security Alliance (CSA) note, or the CISA KEV feed (checked 30 October) for CVE-2026-113603. CSA writes that neither V12 nor the Foundation has reported exploitation in the wild, citing The Hacker News, which we could not open. That is an absence of reports, not proof that no one used the flaws.
Why does npm audit not flag the vulnerable versions?
CSA reports that the repository has published only two advisories, neither covering the August findings, and that the GitHub Advisory Database had no entries for @x402/fetch or @x402/extensions as of 26 October. Scanners that rely on advisories therefore have nothing to match. Compare installed versions against the fixed releases directly.
Which versions contain the fixes for the three critical issues?
CSA lists the TypeScript packages @x402/fetch, @x402/axios, @x402/extensions and @x402/svm as fixed in 2.23.0 or later, and the Python and Go clients as fixed in releases from 18 August 2026 or later. We checked the @x402/fetch 2.23.0 publish date (18 August) in the npm registry; the other versions come from CSA alone. V12's post does not state fix versions. These releases do not fix CVE-2026-113603, the separate SIWx server-side bug.