V12 reports 25 vulnerabilities in x402 code, detailing three rated critical: payment verification without a transfer, signing for an unrelated website, and automated payment authorization without spending limits. It says all three critical issues were fixed by 2026-08-20; the report describes local tests and possible impacts, not observed wallet theft.
Why it matters
It puts payment amount, website identity and verification boundaries around agent spending under scrutiny.
Key facts
As stated in the sources, with where to find them.
- V12 reported three critical and 13 high-severity findings on 2026-08-12, and nine medium/low findings on September 9. It gives fix status for the three critical issues, not all 25.Disclosure and fixes
- The payment-bypass test used real token encoders and parsing locally without submitting a live transaction. The spending issue assumes an automatic signer without an application-supplied policy and a compatible funded token balance.An approval was accepted as a payment, without transferring funds; Default client setup had no spending limit
Findings that cite this record
No tracked finding cites this record yet.
Sources
Related records
Oct 1, 2026
Sep 30, 2026
Sep 30, 2026
Oct 13, 2026
Oct 2, 2026
Sep 29, 2026