CVE-2026-104891

7.5 HIGHpublic exploit available

Published 2026-10-05 · Updated 2026-10-06

AI risk analysis

Summary: The flaw allows unauthenticated attackers to bypass payment requirements by providing any valid wallet address that meets on-chain conditions, enabling free access to paid content without proving wallet ownership. This creates a significant authorization bypass where attackers can reuse cached grants indefinitely.
Exploitability: Easy to exploit with no authentication required - attackers simply need to submit any qualifying wallet address in the credential.source field to gain free access to protected content.
Blast radius: Widespread impact across all applications using the vulnerable mppx-condition-gate and mppx-token-gate packages, potentially allowing attackers to access premium content, services, or features that should require payment.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to @insumermodel/mppx-condition-gate 3.0.0 and @insumermodel/mppx-token-gate 1.0.4 immediately

auth-bypasspaymentaccess-controlwallet

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

mppx-condition-gate provides conditional free-access wrappers for mppx payment methods. Prior to @insumermodel/mppx-condition-gate 3.0.0 and @insumermodel/mppx-token-gate 1.0.4, the packages read a wallet address from the client-supplied credential.source, checked whether that public address met configured on-chain conditions, and returned a successful free-access receipt without invoking the wrapped payment verifier or proving that the caller controlled the wallet. An unauthenticated attacker could name any qualifying wallet and obtain content that should require payment, and cached grants could be reused for the configured cache lifetime. The corrected packages prevent free-access authorization unless payer control has been established. These issues are fixed in @insumermodel/mppx-condition-gate 3.0.0 and @insumermodel/mppx-token-gate 1.0.4.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-290, CWE-863

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.