AIKIDO-2026-379537
x402 is vulnerable to Authorization Bypass
48
Medium Risk
This Affects:
x402TL;DR
The Flask payment middleware in the x402 Python SDK gates onchain settlement on a status code between 200 and 299, so responses in the 3xx range fall through the settlement path. When a payment-protected route returns a redirect, the buffered response body is released to the client while settlement and override handling are skipped, so paid content is delivered without the onchain payment being captured. This lets a client receive protected content behind a redirect without completing payment. The fix treats any response below 400 as successful so settlement and override handling still run for 3xx responses.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your resource server uses the Flask payment middleware to protect routes that can return a 3xx redirect response.
Background info
x402 is vulnerable to Authorization Bypass in versions 2.0.0 - 2.14.0.
How to fix this
Upgrade the x402 library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant