CVE-2026-104891High· 7.5▾ Twilightmppx-condition-gate provides conditional free-access wrappers for mppx payment methods. Prior to @insumermodel/mppx-condition-gate 3.0.0 and @insumermodel/mppx-token-gate 1.0.4, the packages read a wallet address from the client-supplied…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
mppx-condition-gate provides conditional free-access wrappers for mppx payment methods. Prior to @insumermodel/mppx-condition-gate 3.0.0 and @insumermodel/mppx-token-gate 1.0.4, the packages read a wallet address from the client-supplied credential.source, checked whether that public address met configured on-chain conditions, and returned a successful free-access receipt without invoking the wrapped payment verifier or proving that the caller controlled the wallet. An unauthenticated attacker could name any qualifying wallet and obtain content that should require payment, and cached grants could be reused for the configured cache lifetime. The corrected packages prevent free-access authorization unless payer control has been established. These issues are fixed in @insumermodel/mppx-condition-gate 3.0.0 and @insumermodel/mppx-token-gate 1.0.4.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
@insumermodel/mppx-condition-gate <= 2.0.3@insumermodel/mppx-token-gate <= 1.0.3Patched in:
@insumermodel/mppx-condition-gate 3.0.0@insumermodel/mppx-token-gate 1.0.4Connected by shared product, vendor, weakness, or advisory.
CVE-2026-107336Medium· 6.5Malcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" location using a case-insensitive regex matcher but a case-sensitive rewrite
CVE-2026-62224Medium· 5.4OpenClaw MS Teams before 2026.5.12 contain an authorization bypass vulnerability where the allowFrom feature binds to mutable display names
CVE-2026-67411High· 7.1RabbitMQ is a messaging and streaming broker
CVE-2026-53817High· 8.0OpenClaw: Control UI locality spoofing could mint a durable admin device token
CVE-2026-25660CriticalCodechecker has an authentication bypass for certain API calls
CVE-2026-106460Medium· 6.8Backstage is an open framework for building developer portals