The x402 Sign‑In‑With‑X (SIWX) server extension allows a client to unlock a route that is normally protected by payment when the client supplies a PaymentPayload.resource URL that does not match the route the client actually requests. This flaw lets a user pay only for a low‑cost route and then repeatedly access a more expensive route by including the mismatched resource URL. The impact is a financial loss from unauthorized use of paid content and a denial of the intended payment gating mechanism. The weakness is classified as CWE‑639, Access Control—Missing Authorization Check.

Affected versions include the @x402/extensions package from v2.3.1 through v2.28.0, the x402 PyPI package from v2.11.0 through v2.25.0, and the Go module from v2.16.0 through v2.28.0, all maintained by the x402 Foundation. Any deployment using these packages and the SIWX extension is vulnerable unless the affected range is updated elsewhere.

The CVSS score of 6.9 indicates moderate severity due to the ability to bypass payment gating. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote over the network, where an attacker can send an HTTP request with a SIGN‑IN‑WITH‑X header and a crafted PaymentPayload.resource URL to access an otherwise unpaid route. Exploitation requires only authentication as a paying client, making the flaw readily exploitable once the vulnerable extension is in use.