{"id":"CVE-2026-104891","published":"2026-10-05T16:17:06.447","lastModified":"2026-10-06T16:08:43.180","description":"mppx-condition-gate provides conditional free-access wrappers for mppx payment methods. Prior to @insumermodel/mppx-condition-gate 3.0.0 and @insumermodel/mppx-token-gate 1.0.4, the packages read a wallet address from the client-supplied credential.source, checked whether that public address met configured on-chain conditions, and returned a successful free-access receipt without invoking the wrapped payment verifier or proving that the caller controlled the wallet. An unauthenticated attacker could name any qualifying wallet and obtain content that should require payment, and cached grants could be reused for the configured cache lifetime. The corrected packages prevent free-access authorization unless payer control has been established. These issues are fixed in @insumermodel/mppx-condition-gate 3.0.0 and @insumermodel/mppx-token-gate 1.0.4.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-290","CWE-863"],"vendors":[],"products":[],"references":[{"url":"https://github.com/insumerapi/mppx-condition-gate/commit/b1d9935a57ba6d32da49eead1bfb459ad0cd55ab","tags":[]},{"url":"https://github.com/insumerapi/mppx-condition-gate/commit/ec43a2fcd443a0fa102b6d4203abed2b785bd954","tags":[]},{"url":"https://github.com/insumerapi/mppx-condition-gate/security/advisories/GHSA-jg6q-3qfh-r9f8","tags":[]}],"exploitRefs":[{"url":"https://github.com/insumerapi/mppx-condition-gate/commit/b1d9935a57ba6d32da49eead1bfb459ad0cd55ab","tags":[]},{"url":"https://github.com/insumerapi/mppx-condition-gate/commit/ec43a2fcd443a0fa102b6d4203abed2b785bd954","tags":[]},{"url":"https://github.com/insumerapi/mppx-condition-gate/security/advisories/GHSA-jg6q-3qfh-r9f8","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows unauthenticated attackers to bypass payment requirements by providing any valid wallet address that meets on-chain conditions, enabling free access to paid content without proving wallet ownership. This creates a significant authorization bypass where attackers can reuse cached grants indefinitely.","exploitability":"Easy to exploit with no authentication required - attackers simply need to submit any qualifying wallet address in the credential.source field to gain free access to protected content.","blast_radius":"Widespread impact across all applications using the vulnerable mppx-condition-gate and mppx-token-gate packages, potentially allowing attackers to access premium content, services, or features that should require payment.","remediation":"Upgrade to @insumermodel/mppx-condition-gate 3.0.0 and @insumermodel/mppx-token-gate 1.0.4 immediately","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","payment","access-control","wallet"],"model":"garnet-coder","analyzedAt":"2026-10-13T09:03:39.386Z"}}