{
  "schema_version": "1",
  "generated_at": "2026-10-24T00:00:00Z",
  "tag": "siwx",
  "count": 1,
  "entries": [
    {
      "id": "v12-x402-25-vulnerabilities",
      "title": "25 Vulnerabilities in the x402 Protocol: Inside Three Critical Findings",
      "publisher": "V12",
      "authors": [],
      "date_published": "2026-10-22",
      "url": "https://v12.sh/blog/x402",
      "type": "report",
      "category": "safety-security",
      "status": "research",
      "summary": "V12 reports 25 vulnerabilities in the x402 codebase and details three critical ones: a Solana token approval accepted as payment by the TypeScript facilitator, SIWx login messages signed for a different site, and a default client with no spending limit. All three were reported on 2026-08-12 and fixed by 2026-08-20. According to The Hacker News (2026-10-23), the fixes are in @x402/fetch, @x402/axios, @x402/extensions and @x402/svm 2.23.0 or later, patched clients cap each payment at $1 and accept only recognized stablecoins by default (spendControls: false disables this), and no formal security advisory was published. Related: https://thehackernews.com/2026/10/critical-x402-sdk-flaw-could-let.html.",
      "tags": [
        "x402",
        "security",
        "vulnerabilities",
        "spend-controls",
        "siwx",
        "solana",
        "sdk"
      ],
      "verified_at": "2026-10-24",
      "featured": false,
      "last_checked": "2026-10-24",
      "http_status": 200,
      "archive_url": null
    }
  ]
}