---
id: CVE-2026-104891
title: >-
  mppx-condition-gate provides conditional free-access wrappers for mppx payment
  methods
summary: >-
  mppx-condition-gate provides conditional free-access wrappers for mppx payment
  methods. Prior to @insumermodel/mppx-condition-gate 3.0.0 and
  @insumermodel/mppx-token-gate 1.0.4, the packages read a wallet address from
  the client-supplied…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-290
  - CWE-863
vendor: douglasborthwick-crypto
product: mppx-condition-gate
affected:
  - mppx-condition-gate < b1d9935a57ba6d32da49eead1bfb459ad0cd55ab
  - mppx-condition-gate < 3.0.0
  - mppx-token-gate < 1.0.4
published: '2026-10-05'
updated: '2026-10-05'
sourceUpdated: '2026-10-05T16:17:06.447'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-104891'
references:
  - url: >-
      https://github.com/insumerapi/mppx-condition-gate/commit/b1d9935a57ba6d32da49eead1bfb459ad0cd55ab
    label: security-advisories@github.com
  - url: >-
      https://github.com/insumerapi/mppx-condition-gate/commit/ec43a2fcd443a0fa102b6d4203abed2b785bd954
    label: security-advisories@github.com
  - url: >-
      https://github.com/insumerapi/mppx-condition-gate/security/advisories/GHSA-jg6q-3qfh-r9f8
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-05T16:25:58.410Z'
---

## Overview

mppx-condition-gate provides conditional free-access wrappers for mppx payment methods. Prior to @insumermodel/mppx-condition-gate 3.0.0 and @insumermodel/mppx-token-gate 1.0.4, the packages read a wallet address from the client-supplied credential.source, checked whether that public address met configured on-chain conditions, and returned a successful free-access receipt without invoking the wrapped payment verifier or proving that the caller controlled the wallet. An unauthenticated attacker could name any qualifying wallet and obtain content that should require payment, and cached grants could be reused for the configured cache lifetime. The corrected packages prevent free-access authorization unless payer control has been established. These issues are fixed in @insumermodel/mppx-condition-gate 3.0.0 and @insumermodel/mppx-token-gate 1.0.4.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.