CVE-2026-59695

In ZenHive mpp before version 0.16.2, use of cache containing sensitive information allows a shared HTTP cache to store a paid response and serve it to clients that never paid. MPP.Plug.verify_credential sets payment-receipt and cache-control: private, but a mounting application can override them, e.g., by setting cache-control: public, allowing a CDN or reverse proxy to store the paid response and serve it to unpaid clients. Additionally, non-2xx responses may still carry Payment-Receipt.

In ZenHive mpp before version 0.16.2, improper validation of unsafe equivalence in input allows an unauthenticated remote client to pass the Tempo duplicate-submission gate twice with one signed transaction. MPP.Methods.Tempo reserves the pre-broadcast dedup slot based on caller-supplied hex, not on a canonical form, allowing two different reserve keys for the same transaction (e.g., v=27 and v=0). As a result, both pass the reserve and reach the broadcast path, and a node may return a second valid Payment-Receipt for a single on-chain payment.

A vulnerability in the mpp library (ZenHive) allows an unauthenticated remote client to inflate the fee-payer's gas cost by adding a large number of fabricated EIP-2930 access list entries. The server co-signs the transaction without validating the list length or contents, leading to a multiple increase in gas costs.

A vulnerability in the mpp library (ZenHive) allows an unauthenticated remote client to drain the fee-payer wallet by submitting EVM transactions with a deliberately low gas limit. The server co-signs and broadcasts the transaction, which fails due to out-of-gas, but the fee-payer wallet is charged for the burned gas while the attacker pays nothing. This leads to denial of service for legitimate clients as the fee-payer wallet runs out of funds.