Read the docs
TI-2026-67744 Aliases CVE-2026-104891GHSA-jg6q-3qfh-r9f8

Missing payer check lets callers get free access in mppx-condition-gate

Priority LOW 39CWE-290Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-290.

Summary

Before @insumermodel/mppx-condition-gate 3.0.0 and @insumermodel/mppx-token-gate 1.0.4, the packages trust a wallet address supplied by the client in credential.source. They grant free access when that public address meets configured on-chain conditions, without checking wallet control (CWE-290). An unauthenticated attacker can name any qualifying wallet to get content that requires payment, and cached grants can be reused for the configured cache lifetime.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

mppx-condition-gate provides conditional free-access wrappers for mppx payment methods. Prior to @insumermodel/mppx-condition-gate 3.0.0 and @insumermodel/mppx-token-gate 1.0.4, the packages read a wallet address from the client-supplied credential.source, checked whether that public address met configured on-chain conditions, and returned a successful free-access receipt without invoking the wrapped payment verifier or proving that the caller controlled the wallet. An unauthenticated attacker could name any qualifying wallet and obtain content that should require payment, and cached grants could be reused for the configured cache lifetime. The corrected packages prevent free-access authorization unless payer control has been established. These issues are fixed in @insumermodel/mppx-condition-gate 3.0.0 and @insumermodel/mppx-token-gate 1.0.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00282 20th percentileScored 2026-11-07
Fix Fixed mppx-condition-gate (@insumermodel): 3.0.0mppx-token-gate (@insumermodel): 1.0.4+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
douglasborthwick-cryptomppx-condition-gate< b1d9935a57ba6d32da49eead1bfb459ad0cd55ab—No fix listedCNA
@insumermodelmppx-condition-gatebefore 3.0.03.0.0Patch availableCNA
@insumermodelmppx-token-gatebefore 1.0.41.0.4Patch availableCNA
—@insumermodel/mppx-condition-gate (npm)before 3.0.03.0.0Patch availableGHSA-jg6q-3qfh-r9f8
—@insumermodel/mppx-token-gate (npm)before 1.0.41.0.4Patch availableGHSA-jg6q-3qfh-r9f8
  • mppx-condition-gate Vendordouglasborthwick-crypto Affected < b1d9935a57ba6d32da49eead1bfb459ad0cd55ab Fixed in — No fix listed CNA
  • mppx-condition-gate Vendor@insumermodel Affected before 3.0.0 Fixed in 3.0.0 Patch available CNA
  • mppx-token-gate Vendor@insumermodel Affected before 1.0.4 Fixed in 1.0.4 Patch available CNA
  • @insumermodel/mppx-condition-gate (npm) Vendor— Affected before 3.0.0 Fixed in 3.0.0 Patch available GHSA-jg6q-3qfh-r9f8
  • @insumermodel/mppx-token-gate (npm) Vendor— Affected before 1.0.4 Fixed in 1.0.4 Patch available GHSA-jg6q-3qfh-r9f8

Remediation

Upgrade to @insumermodel/mppx-condition-gate 3.0.0 and @insumermodel/mppx-token-gate 1.0.4, which fix the issue. The sources list no fixed version for douglasborthwick-crypto mppx-condition-gate.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA mppx-condition-gate (@insumermodel) Fixed in 3.0.0
  • Fix · CNA mppx-token-gate (@insumermodel) Fixed in 1.0.4
  • Fix · GHSA-jg6q-3qfh-r9f8 @insumermodel/mppx-condition-gate (npm) Fixed in 3.0.0 Advisory →
  • Fix · GHSA-jg6q-3qfh-r9f8 @insumermodel/mppx-token-gate (npm) Fixed in 1.0.4 Advisory →

Timeline

  1. 2026-10-05 Threatist record created from CVE-2026-104891
  2. 2026-10-06 CISA SSVC decision points changed
  3. 2026-10-06 Priority changed: MEDIUM → LOW
  4. 2026-10-07 Alias added: GHSA-jg6q-3qfh-r9f8
  5. 2026-10-07 Fix available: npm/@insumermodel/[email protected], npm/@insumermodel/[email protected] · GHSA-jg6q-3qfh-r9f8
  6. 2026-10-07 CVSS score added · GHSA-jg6q-3qfh-r9f8
  7. 2026-10-07 Weakness changed · GHSA-jg6q-3qfh-r9f8
  8. 2026-10-07 6 new references · GHSA-jg6q-3qfh-r9f8

References

Advisory 1

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences