1vulnerability
- Critical0 (0.0%)
- High1 (100.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
insumermodel-mppx-condition-gate
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 1HighAffects 1 version
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting insumermodel-mppx-condition-gate, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-jg6q-3qfh-r9f8 | High | mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control### Impact Both packages wrap an `mppx` payment method so that a wallet meeting on-chain conditions is granted free access instead of being charged. The free-access path reads the payer address from `credential.source` — a client-supplied DID in the payment credential — asks InsumerAPI whether that address satisfies the configured conditions, and on a pass returns a successful receipt **without ever calling the wrapped payment verifier**. Nothing in that path establishes that the caller controls the wallet it named. Because qualifying wallets are public chain state, an attacker does not nee |
| GitHub (opens in a new tab) |
- GHSA-jg6q-3qfh-r9f8Highmppx-condition-gate: Free-access path grants on a self-declared wallet without proving control
< 3.0.0
### Impact Both packages wrap an `mppx` payment method so that a wallet meeting on-chain conditions is granted free access instead of being charged. The free-access path reads the payer address from `credential.source` — a client-supplied DID in the payment credential — asks InsumerAPI whether that address satisfies the configured conditions, and on a pass returns a successful receipt **without ever calling the wrapped payment verifier**. Nothing in that path establishes that the caller controls the wallet it named. Because qualifying wallets are public chain state, an attacker does not nee
CVE: CVE-2026-104891