CVE-2026-104891: mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control
mppx-condition-gate provides conditional free-access wrappers for mppx payment methods. Prior to @insumermodel/mppx-condition-gate 3.0.0 and @insumermodel/mppx-token-gate 1.0.4, the packages read a wallet address from the client-supplied credential.source, checked whether that public address met configured on-chain conditions, and returned a successful free-access receipt without invoking the wrapped payment verifier or proving that the caller controlled the wallet. An unauthenticated attacker could name any qualifying wallet and obtain content that should require payment, and cached grants could be reused for the configured cache lifetime. The corrected packages prevent free-access authorization unless payer control has been established. These issues are fixed in @insumermodel/mppx-condition-gate 3.0.0 and @insumermodel/mppx-token-gate 1.0.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@insumermodel/mppx-condition-gateto a version that resolves this vulnerability.Fixed in 3.0.0 - Upgrade
Upgrade
@insumermodel/mppx-token-gateto a version that resolves this vulnerability.Fixed in 1.0.4
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using versions earlier than @insumermodel/mppx-condition-gate 3.0.0 or @insumermodel/mppx-token-gate 1.0.4 are affected when they use the conditional free-access wrappers. The issue applies where configured on-chain conditions can qualify a wallet for free access.
What does an attacker need to exploit this?
An attacker does not need authentication, payment, or control of a qualifying wallet. They only need to submit a client-supplied credential.source that names a public wallet address meeting the configured on-chain condition.
What is the impact of a successful exploit?
An attacker can receive a successful free-access receipt and access content that should require payment, without the wrapped payment verifier being invoked. Cached grants may also be reused for the configured cache lifetime.
How can this be remediated?
Upgrade @insumermodel/mppx-condition-gate to version 3.0.0 or later, and @insumermodel/mppx-token-gate to version 1.0.4 or later. The corrected packages require payer control to be established before free-access authorization is granted.