// AI threat desk · 24 Oct 2026
Home/AGENT · Agent Security
Agent SecurityMediumX402CVSS not assigned

x402 vulnerabilities could bypass payments and expose wallets

V12 disclosed three critical x402 vulnerabilities that could bypass payments, sign in to target sites as a wallet, or authorize a client’s full token balance. V12 published its findings Oct 22, 2026.

· 3 min read
AI-generated image of security analysts examining payment software beside a hardware wallet in a dim operations centre.
AI-generated image, not a photo of the event.
Key takeaways
  • V12 found 25 vulnerabilities in the x402 codebase and focused its report on three critical findings.
  • A payment bypass could let a merchant deliver a paid resource while receiving no tokens.
  • The three critical vulnerabilities were fixed by Aug 20, 2026.

V12 disclosed three critical vulnerabilities in x402 on Oct 22, 2026, after reporting them to the x402 team on Aug 12. The x402 team fixed the three flaws by Aug 20, V12 said.

The flaws affected payment verification, automatic sign-in and automated payment clients. One could let a merchant deliver a paid resource without receiving tokens, another could let a malicious data server use a client wallet’s signature to log in to a target site, and a third could let a hostile API request authorization for a compatible token’s full balance.

V12 said it reviewed the x402 codebase and found 25 vulnerabilities, focusing its report on the three critical findings.

On this page

A Solana verification path returned valid for an approval

V12’s local test used the real token encoders and parser and confirmed that the verification path returned isValid: true for an approval.

An attacker needed a valid token account but no token balance for the approval, while the facilitator paid the transaction fee. V12 said the Solana verifier should check the instruction type before parsing it as a transfer.

The sign-in wrapper did not match domains or spending limits

The automatic sign-in wrapper signed messages supplied in a 402 response without checking whether their domain and URI matched the website the client had contacted. A malicious data server could place its challenge in the extension, collect the client’s signature and submit it to a target site to log in as the client’s wallet.

The documented default client setup enforced neither a per-payment limit nor a total spending budget. With an automatic signer and no application policy, the client could sign an authorization that an attacker could submit to collect funds.

V12 also found malformed payment requirements reaching the selector even though the schema validator would have rejected them. It said payment clients should validate incoming requirements and enforce explicit per-payment and total budgets, permitted tokens, networks and recipients.

x402 releases added spend controls and an instruction check

The x402 Foundation said the Aug 18 releases added spend controls to the TypeScript, Python and Go clients. It said the patched clients cap each payment at $1 by default and allow only recognized US dollar stablecoins, such as USDC.

The Hacker News said every published @x402/svm release from 2.0.0 through 2.22.0 lacked the instruction-type check, while every release from 2.23.0 onward included it.

V12 said it submitted nine additional medium- and low-severity findings on Sep 9, 2026.

ReleasesInstruction-type check
2.0.0 through 2.22.0Lacked the check
2.23.0 onwardIncluded the check

What to do now

  1. Check the instruction type before parsing it as a transfer.
  2. Compare the requested domain and URI with the contacted website before signing.
  3. Validate incoming requirements and enforce explicit per-payment and total budgets, permitted tokens, networks and recipients.

FAQ

What happened to x402?

V12 disclosed three critical vulnerabilities in the x402 codebase after finding 25 vulnerabilities overall. The three critical vulnerabilities were fixed by Aug 20, 2026.

Could the x402 flaws bypass payments?

Yes. V12 said a payment bypass could let a merchant deliver a paid resource while receiving no tokens.

Could an x402 flaw expose a wallet login?

Yes. A malicious data server could obtain a client wallet’s signature and use it to log in to a target site as the client’s wallet.

Which x402 clients received spend controls?

The x402 Foundation said Aug 18 releases added spend controls to the TypeScript, Python and Go clients. It said the default cap is $1 per payment and recognized US dollar stablecoins such as USDC are allowed.

Which x402 Solana releases include the instruction check?

According to The Hacker News, releases from 2.23.0 onward include the check, while releases from 2.0.0 through 2.22.0 lack it.

Sources

  1. 25 Vulnerabilities in the x402 Protocol: Inside Three Critical Findings, V12Primary
  2. Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances, The Hacker News
  3. API, Wikipedia
How we checked this story
ClaimSourceStatus
V12 found 25 vulnerabilities in the x402 codebase.V12Confirmed
V12 focused its report on three critical findings.V12Confirmed
V12 reported the three critical and 13 high-severity findings to the x402 team on August 12, 2026.V12Confirmed
The three critical vulnerabilities were fixed by August 20, 2026.V12Confirmed
V12 submitted nine further medium- and low-severity findings on September 9, 2026.V12Confirmed
A TypeScript Solana facilitator accepted an approval as a valid payment without transferring funds.V12Confirmed
The payment bypass could let a merchant deliver a paid resource while receiving no tokens.V12Confirmed
An attacker needed a valid token account but no token balance for the approval, while the facilitator paid the transaction fee.V12Confirmed
The automatic sign-in wrapper signed messages without checking their domain and URI against the contacted website.V12Confirmed
A malicious data server could obtain a client wallet’s signature and use it to log in to a target site.V12Confirmed
The default client setup enforced neither a per-payment limit nor a total spending budget.V12Confirmed
A hostile API could request authorization for an automated client’s full balance of a compatible token.V12Confirmed
With an automatic signer and no application policy, the client could sign authorization that an attacker could submit to collect funds.V12Confirmed
V12 found that malformed payment requirements could reach the selector without schema validation.V12Confirmed
The x402 team added spend controls to its TypeScript, Python, and Go clients in releases on August 18, 2026.x402 Foundation, via The Hacker NewsAttributed
x402 Foundation said the patched clients cap each payment at $1 by default and allow recognized US dollar stablecoins such as USDC.x402 Foundation, via The Hacker NewsAttributed
The Hacker News said the TypeScript Solana facilitator lacked the instruction-type check in releases 2.0.0 through 2.22.0, while releases from 2.23.0 included it.The Hacker NewsAttributed
An API is a connection between computers or computer programs.WikipediaConfirmed
v12.sh published its report on Oct 22, 2026.v12.shConfirmed

Could not verify

  • Whether the vulnerabilities were exploited in the wild is not established
  • Whether the findings received CVE identifiers is not established
  • How many x402 deployments or users were affected is not established
  • Whether any funds or login accounts were compromised is not established
See all in Agent Security →
Explore with AI
ChatGPT
Claude
Perplexity
Grok