CVE-2026-104891: mppx-condition-gate and mppx-token-gate Free-Access Path Vulnerability
Summary
CVE-2026-104891: mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control. Affects @insumermodel/mppx-condition-gate versions < 3.0.0. Fixed in 3.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The packages @insumermodel/mppx-condition-gate and @insumermodel/mppx-token-gate are designed to facilitate payments through the mppx payment method by allowing wallets that meet specific on-chain conditions to gain free access. These packages are intended to enhance payment processing by validating wallet conditions, but they have a critical vulnerability that allows unauthorized access without proper wallet control verification.
Vulnerability Detail
The vulnerability arises from a flaw in the control flow of both packages, which allows any user to specify a wallet address in the 'credential.source' field without proving control over that wallet. This means that an attacker can gain free access to services by simply naming a qualifying wallet address, bypassing the payment verification process. The issue is rooted in the packages' failure to validate the relationship between the caller and the specified wallet address, leading to unauthorized access. The vulnerability affects all versions of the packages since their initial release, posing a significant risk to users relying on these payment methods.
How To Fix
Latest published version: 3.2.1 as of 22 Oct 2026
npm install @insumermodel/mppx-condition-gate@3.2.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.0.0
This is the first release that contains the fix.
npm install @insumermodel/mppx-condition-gate@3.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can remove the condition gate from the payment method to ensure that all requests follow the normal paid path. Alternatively, ensure that the wrapped payment method has already bound the credential to the payer before consulting the gate.
Conclusion
The vulnerability identified as CVE-2026-104891 in the @insumermodel/mppx-condition-gate and @insumermodel/mppx-token-gate packages poses a significant risk by allowing unauthorized free access to services. It is crucial for users to update to the patched versions or implement workarounds to mitigate the risk until updates can be applied.
See every vulnerability recorded for @insumermodel/mppx-condition-gate →
FAQ
The vulnerability allows unauthorized access to services by permitting users to specify wallet addresses without proving control over them.
The affected packages are @insumermodel/mppx-condition-gate and @insumermodel/mppx-token-gate.
Every published version of both packages is affected, starting from their initial releases.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just package-lock.json. You can also check your application using the Vulert playground without any signup.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
