Security firm V12 published a report detailing 25 flaws discovered in the x402 SDK code, which standardizes internet-native payments for AI agents and applications.
Developers using x402 libraries can review the findings regarding default spend controls, payment validation, and signing extensions patched in August.
The affected system, called x402, was originally created by Coinbase and is now managed by a foundation that includes major payment companies like Visa and Mastercard. The technology allows apps and AI systems to automatically pay for data or services directly when visiting a website, without the need for a human to approve each payment.
According to cybersecurity firm V12, which discovered a total of 25 issues in the code, three of them were particularly dangerous. The most serious involved the way the software handled payments. Initially, there was no limit to how much money an AI program could automatically send. If a malicious website requested it, the system could authorize a payment for the entire balance of the digital wallet.
A second issue affected the code for the Solana network, as the system accepted a simple authorization of rights as a valid payment without verifying what was actually happening. Thus, a website could pass through without actually being paid.
READ ALSO
Millions of website attack attempts exploit serious PHP security flaws
The third issue was related to the website login feature. The software automatically signed login messages without checking whether the website requesting them was actually the one the program was communicating with. This way, a malicious website could use the credentials to log in elsewhere impersonating the user.
The system's developers released fixes on August 18, adding spending limits, transaction checks, and secure login validations. So far, there have been no reports of these issues being exploited in real-world attacks.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)