AGR-2026-055 — Payment-method verification failures escape instead of producing a retry challenge
Last observed by the head-to-head audit at 2026-08-17T09:21:27.755210Z.
Audited heads
| Target |
Repository |
Commit |
Conformance |
Semantic review |
typescript |
wevm/mppx |
38d4cdc80301 |
Complete |
Reference |
java |
stripe/mpp-java |
b91d89e62d80 |
Complete |
Complete |
go |
tempoxyz/mpp-go |
fd01098f563b |
Complete |
Complete |
python |
tempoxyz/pympp |
9677facba7c2 |
Complete |
Complete |
ruby |
stripe/mpp-rb |
a500eac1b489 |
Complete |
Complete |
rust |
tempoxyz/mpp-rs |
1162fc9bcb09 |
Complete |
Complete |
Finding
- Fingerprint:
semantic:http-errors/failed-payment-returns-fresh-challenge
- Source: semantic
- Affected SDKs:
java
- Clean SDKs: none
- Not reported by semantic review:
go, python, ruby, rust
- Canonical reference:
draft-ietf-httpauth-payment § Status Codes
- Severity: medium
- Confidence: high
Evidence
| SDK |
Canonical evidence |
SDK evidence |
Suggested test |
java |
createHandler — Wraps method validation and broadcast in a try/catch and returns status 402 with a newly emitted challenge when verification fails. |
verifyOrChallenge — Calls intent.verify after the challenge-validation catch block, allowing all method verification exceptions to escape. |
Submit a valid, HMAC-bound Stripe credential whose PaymentIntent returns requires_action; assert the handler returns Challenged with a fresh challenge rather than throwing PaymentActionRequiredException. |
java: After authenticating a credential, the target invokes method verification outside its error-to-challenge handling. Method failures such as insufficient funds, required action, transaction reversion, or relay rejection therefore propagate as exceptions rather than returning the challenged result needed for an HTTP 402 response. Canonical mppx catches both typed payment errors and unexpected verification errors and issues a fresh challenge.
Available /ag commands
Post a command as a new comment. Only configured maintainers can run these commands.
| Command |
What it does |
/ag status |
Reports the current state of linked remediation pull requests. |
/ag fix is unavailable for java because the affected SDK is configured for notification-only automation.
AGR-2026-055 — Payment-method verification failures escape instead of producing a retry challenge
Last observed by the head-to-head audit at
2026-08-17T09:21:27.755210Z.Audited heads
typescriptwevm/mppx38d4cdc80301javastripe/mpp-javab91d89e62d80gotempoxyz/mpp-gofd01098f563bpythontempoxyz/pympp9677facba7c2rubystripe/mpp-rba500eac1b489rusttempoxyz/mpp-rs1162fc9bcb09Finding
semantic:http-errors/failed-payment-returns-fresh-challengejavago,python,ruby,rustdraft-ietf-httpauth-payment § Status CodesEvidence
javajava: After authenticating a credential, the target invokes method verification outside its error-to-challenge handling. Method failures such as insufficient funds, required action, transaction reversion, or relay rejection therefore propagate as exceptions rather than returning the challenged result needed for an HTTP 402 response. Canonical mppx catches both typed payment errors and unexpected verification errors and issues a fresh challenge.
Available
/agcommandsPost a command as a new comment. Only configured maintainers can run these commands.
/ag status