# x402 SDK flaws could let malicious APIs drain AI agents' token balances · pwn.watch > V12 disclosed 25 flaws in the x402 agent-payment SDKs, three rated critical: the default client had no spending limit (a hostile API could ask for an agent's whole token balance), the TypeScript Solana facilitator accepted token approvals as payments, and the SIWx login helper signed messages for other websites. All three were fixed in the August 18 releases, but no advisory was published, so npm audit and PyPI don't warn. Update @x402/fetch, @x402/axios, @x402/extensions and @x402/svm to 2.23.0 or later. Page: https://pwn.watch/i/x402-sdk-critical-flaws-v12 · generated 2026-10-23T11:47:48.642Z ## Status - Severity: critical · status: live · patch: patched - Product: x402 SDKs (TypeScript @x402/*, Python x402, Go) - Started: 2026-10-22 - Affected: @x402/svm 2.0.0 to 2.22.0 (Solana approval accepted as payment); @x402/fetch and @x402/axios before 2.23.0 (no default spending limit); @x402/extensions before 2.23.0 (SIWx signs logins for other sites); Python and Go clients before the August 18, 2026 releases (no spending limit, SIWx check) - Fixed in: @x402/fetch, @x402/axios, @x402/extensions, @x402/svm 2.23.0+ (latest 2.28.0); x402 (PyPI) 2.25.0 (latest); Go module v2.28.0 (latest) ## Follow this incident - RSS (one item per update): https://pwn.watch/i/x402-sdk-critical-flaws-v12/feed.xml - JSON Feed: https://pwn.watch/i/x402-sdk-critical-flaws-v12/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/x402-sdk-critical-flaws-v12.json - This file: https://pwn.watch/i/x402-sdk-critical-flaws-v12/llms.txt ## Updates (newest first) - 2026-10-23: The Hacker News found the foundation published no security advisory for the three flaws, so npm audit and PyPI report nothing for the last vulnerable releases. Patched clients now cap each payment at $1 and allow only recognized USD stablecoins unless the app sets its own spend controls. (https://thehackernews.com/2026/10/critical-x402-sdk-flaw-could-let.html) - 2026-10-22: V12 published 25 x402 findings with three critical ones detailed: no default spend limit, Solana ApproveChecked accepted as TransferChecked in the TypeScript facilitator (a complete payment bypass in local tests), and SIWx signing relayed login messages for other domains. The x402 Foundation had fixed all three in the August 18 releases. (https://v12.sh/blog/x402) ## Fix brief # Security brief: x402 SDK flaws could let malicious APIs drain AI agents' token balances Source: https://pwn.watch/i/x402-sdk-critical-flaws-v12 · status: live · severity: critical · updated Oct 23, 2026, 11:25 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is V12 disclosed 25 flaws in the x402 agent-payment SDKs, three rated critical: the default client had no spending limit (a hostile API could ask for an agent's whole token balance), the TypeScript Solana facilitator accepted token approvals as payments, and the SIWx login helper signed messages for other websites. All three were fixed in the August 18 releases, but no advisory was published, so npm audit and PyPI don't warn. Update @x402/fetch, @x402/axios, @x402/extensions and @x402/svm to 2.23.0 or later. Severity detail: Three findings rated critical by V12; no exploitation reported - Product: x402 SDKs (TypeScript @x402/*, Python x402, Go) ## Affected versions - @x402/svm 2.0.0 to 2.22.0 (Solana approval accepted as payment) - @x402/fetch and @x402/axios before 2.23.0 (no default spending limit) - @x402/extensions before 2.23.0 (SIWx signs logins for other sites) - Python and Go clients before the August 18, 2026 releases (no spending limit, SIWx check) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - @x402/fetch, @x402/axios, @x402/extensions, @x402/svm 2.23.0+ (latest 2.28.0) - x402 (PyPI) 2.25.0 (latest) - Go module v2.28.0 (latest) After upgrading, re-run the checks above and redeploy/restart the affected services. ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Latest updates - Oct 23, 2026: The Hacker News found the foundation published no security advisory for the three flaws, so npm audit and PyPI report nothing for the last vulnerable releases. Patched clients now cap each payment at $1 and allow only recognized USD stablecoins unless the app sets its own spend controls. - Oct 22, 2026: V12 published 25 x402 findings with three critical ones detailed: no default spend limit, Solana ApproveChecked accepted as TransferChecked in the TypeScript facilitator (a complete payment bypass in local tests), and SIWx signing relayed login messages for other domains. The x402 Foundation had fixed all three in the August 18 releases. ## Write-ups & news - [25 Vulnerabilities in the x402 Protocol: Inside Three Critical Findings](https://v12.sh/blog/x402) - [Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents' Token Balances](https://thehackernews.com/2026/10/critical-x402-sdk-flaw-could-let.html) ## Caveats No CVE IDs or GitHub advisory for these three findings (an older, separate Solana facilitator advisory, GHSA-qr2g-p6q7-w82m, covered @x402/svm before 2.6.0). Teams that can't upgrade can register a payment policy that drops options above a set amount (registerPolicy in TypeScript and Go, register_policy or max_amount in Python). Apps passing spendControls: false turn the new limits off. Upgrading also picks up a separate September payment-bypass fix in @x402/core 2.27.0. --- Machine-readable: https://pwn.watch/i/x402-sdk-critical-flaws-v12.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.