CVE-2026-104891: mppx-condition-gate Auth Bypass Vulnerability

CVE-2026-104891 Overview

CVE-2026-104891 is an authentication bypass vulnerability [CWE-290] in the @insumermodel/mppx-condition-gate and @insumermodel/mppx-token-gate npm packages. These packages wrap mppx payment methods and grant conditional free access based on on-chain wallet conditions. The affected versions read a wallet address from the client-supplied credential.source field and verified only that the address met the configured conditions. The packages never confirmed that the caller controlled the wallet. An unauthenticated attacker can supply any qualifying public address and receive a free-access receipt for paid content.

Critical Impact
Unauthenticated attackers can bypass payment verification by naming any wallet that meets configured on-chain conditions, and cached grants extend the bypass across the cache lifetime.

Affected Products

@insumermodel/mppx-condition-gate prior to 3.0.0
@insumermodel/mppx-token-gate prior to 1.0.4
Applications integrating these packages as free-access wrappers for mppx payment flows

Discovery Timeline

2026-10-05 - CVE-2026-104891 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-104891

Vulnerability Analysis

The vulnerability resides in the free-access authorization path of both packages. When a request reaches the condition-gate wrapper, the code extracts a wallet address from credential.source supplied directly by the client. The wrapper then evaluates the on-chain condition (such as token balance or NFT ownership) against that address. If the condition passes, the wrapper short-circuits and returns a successful receipt without invoking the wrapped payment verifier.

This flow conflates two separate assertions: whether a wallet qualifies for free access, and whether the caller controls that wallet. The packages validate only the first, allowing any client to assert ownership of a qualifying wallet address. Public blockchain data makes qualifying addresses trivially enumerable.

Cached grants compound the problem. Once a bypass succeeds, the resulting authorization token can be reused by any caller for the configured cache lifetime, extending unauthenticated access to the protected resource.

Root Cause

The root cause is improper authentication [CWE-290] through missing proof of wallet control. A correct implementation requires the caller to sign a server-issued challenge with the wallet's private key, proving possession before any free-access decision. The affected packages omitted this step and treated a client-provided public address as both the identity and the credential.

Attack Vector

The attack is network-based and requires no authentication, no user interaction, and no privileges. An attacker enumerates wallets that satisfy the configured on-chain condition using public blockchain explorers, submits a request to the protected endpoint with credential.source set to one of those addresses, and receives a free-access receipt. The same technique applies to the @insumermodel/mppx-token-gate v1 predecessor, which the maintainers removed in the fix commit.

text

// Patch fragment: removal of the vulnerable v1 token-gate predecessor
// Source: https://github.com/insumerapi/mppx-condition-gate/commit/b1d9935a57ba6d32da49eead1bfb459ad0cd55ab
 .npmrc
 .env
 .env.local
+legacy/*/node_modules
+legacy/*/dist

Detection Methods for CVE-2026-104891

Indicators of Compromise

Access logs showing successful free-access receipts for wallet addresses that never completed a signature challenge or payment flow
Repeated requests from a small set of client IPs that each reference different high-value wallet addresses in credential.source
Reuse of identical cached grant tokens across many unrelated client sessions

Detection Strategies

Audit application logs for free-access authorizations issued without a corresponding payment verifier call or signature verification event
Correlate authorization events with on-chain activity: legitimate holders rarely request access from infrastructure IP ranges or datacenter ASNs
Compare the distribution of wallet addresses in authorization requests against known holder lists to identify enumeration patterns

Monitoring Recommendations

Alert on any invocation of condition-gate code paths from @insumermodel/mppx-condition-gate versions below 3.0.0 or @insumermodel/mppx-token-gate versions below 1.0.4
Monitor rate and uniqueness of wallet addresses submitted per client identifier to detect credential-stuffing-style enumeration
Track cache hit ratios on free-access grants; abnormally high reuse indicates shared bypass tokens

How to Mitigate CVE-2026-104891

Immediate Actions Required

Upgrade @insumermodel/mppx-condition-gate to 3.0.0 and @insumermodel/mppx-token-gate to 1.0.4 across all deployments and build artifacts
Invalidate all cached free-access grants issued by vulnerable versions to prevent continued bypass through reused tokens
Audit recent access logs for free-access receipts that lack a corresponding signature or payment verification record

Patch Information

The maintainers published fixes in @insumermodel/mppx-condition-gate 3.0.0 and @insumermodel/mppx-token-gate 1.0.4. The corrected packages refuse free-access authorization unless payer control of the wallet has been established. Review the GitHub Security Advisory GHSA-jg6q-3qfh-r9f8 and the fix commits b1d9935 and ec43a2f for implementation details.

Workarounds

Disable condition-gate and token-gate free-access wrappers until the patched versions are deployed
Require a signed challenge-response that proves control of credential.source before invoking any gate evaluation
Set the free-access cache lifetime to zero to prevent grant reuse while upgrades propagate

bash

# Upgrade both packages to patched versions
npm install @insumermodel/mppx-condition-gate@^3.0.0
npm install @insumermodel/mppx-token-gate@^1.0.4

# Verify installed versions
npm ls @insumermodel/mppx-condition-gate @insumermodel/mppx-token-gate