{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/events/v12-x402-agent-payment-sdk-flaws-2026/",
 "asOf": "2026-10-30",
 "id": "v12-x402-agent-payment-sdk-flaws-2026",
 "date": "2026-10-22",
 "datePrecision": "day",
 "title": "V12 discloses three critical x402 payment flaws affecting automated clients",
 "lane": "attack",
 "kind": "vulnerability-disclosure",
 "summary": "V12 reports 25 vulnerabilities in x402 code, detailing three rated critical: payment verification without a transfer, signing for an unrelated website, and automated payment authorization without spending limits. It says all three critical issues were fixed by 2026-08-20; the report describes local tests and possible impacts, not observed wallet theft.",
 "whyItMatters": "It puts payment amount, website identity and verification boundaries around agent spending under scrutiny.",
 "actors": [
  "v12"
 ],
 "topics": [
  "tool-and-mcp-security",
  "access-controls"
 ],
 "atlas": [
  "tools",
  "credentials",
  "human-approver"
 ],
 "artifacts": [],
 "sources": [
  {
   "url": "https://v12.sh/blog/x402",
   "publisher": "V12",
   "title": "25 Vulnerabilities in the x402 Protocol: Inside Three Critical Findings",
   "date": "2026-10-22",
   "type": "primary",
   "accessed": "2026-10-24"
  }
 ],
 "keyFacts": [
  {
   "fact": "V12 reported three critical and 13 high-severity findings on 2026-08-12, and nine medium/low findings on September 9. It gives fix status for the three critical issues, not all 25.",
   "locator": "Disclosure and fixes"
  },
  {
   "fact": "The payment-bypass test used real token encoders and parsing locally without submitting a live transaction. The spending issue assumes an automatic signer without an application-supplied policy and a compatible funded token balance.",
   "locator": "An approval was accepted as a payment, without transferring funds; Default client setup had no spending limit"
  }
 ],
 "significance": 3,
 "fideQuestions": [
  "FID-076"
 ],
 "methods": [],
 "review": "assistant-drafted",
 "addedOn": "2026-10-24",
 "revisions": []
}