CVE-2026-88255
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
In ZenHive mpp before version 0.16.2, improper validation of unsafe equivalence in input allows an unauthenticated remote client to pass the Tempo duplicate-submission gate twice with one signed transaction. MPP.Methods.Tempo reserves the pre-broadcast dedup slot based on caller-supplied hex, not on a canonical form, allowing two different reserve keys for the same transaction (e.g., v=27 and v=0). As a result, both pass the reserve and reach the broadcast path, and a node may return a second valid Payment-Receipt for a single on-chain payment.
Risk Assessment
An attacker can obtain multiple payment receipts for a single transaction, potentially leading to financial fraud or compromise of payment system integrity.
Recommendation
Upgrade mpp to version 0.16.2 or later. Monitor transactions for duplicates and consider additional validation mechanisms for canonical transaction form.
Other vulnerabilities in mpp
See all- CVE-2026-89186Medium
In ZenHive mpp before version 0.16.2, use of cache containing sensitive information allows a shared HTTP cache to store a paid response and serve it to clients that never paid. MPP.Plug.verify_credential sets payment-receipt and cache-control: private, but a mounting application can override them, e.g., by setting cache-control: public, allowing a CDN or reverse proxy to store the paid response and serve it to unpaid clients. Additionally, non-2xx responses may still carry Payment-Receipt.
- CVE-2026-59695High
A vulnerability in the ZenHive mpp library allows an unauthenticated remote attacker to drain the fee-payer wallet in a single request by specifying an arbitrarily high gas price. The library does not validate the max_fee_per_gas and max_priority_fee_per_gas fields before co-signing the transaction, causing the server's wallet to be charged inflated costs.
- CVE-2026-59694High
A vulnerability in the mpp library (ZenHive) allows an unauthenticated remote client to inflate the fee-payer's gas cost by adding a large number of fabricated EIP-2930 access list entries. The server co-signs the transaction without validating the list length or contents, leading to a multiple increase in gas costs.
- CVE-2026-59252High
A vulnerability in the mpp library (ZenHive) allows an unauthenticated remote client to drain the fee-payer wallet by submitting EVM transactions with a deliberately low gas limit. The server co-signs and broadcasts the transaction, which fails due to out-of-gas, but the fee-payer wallet is charged for the burned gas while the attacker pays nothing. This leads to denial of service for legitimate clients as the fee-payer wallet runs out of funds.
Original NVD description (English source)
Improper Validation of Unsafe Equivalence in Input in ZenHive mpp allows an unauthenticated remote client to pass the Tempo duplicate-submission gate twice with one signed transaction. MPP.Methods.Tempo reserves the pre-broadcast dedup slot on the caller-supplied hex in reserve_hash_atomic/2, keyed through store_key/1 on tx.raw rather than on a canonical form of the transaction. The deserializer stores the caller's hex verbatim and accepts both recovery-id encodings, so one signed transaction submitted once with v=27 and once with v=0 yields two distinct reserve keys, and both pass the reserve and reach the broadcast path. The plug-level credential replay store is deliberately carved out for tempo in lib/mpp/replay.ex, leaving this reserve as the only gate, and the post-broadcast mark writes the canonical hash key that the raw-keyed reserve never reads. What the duplicate submission yields depends on the node: a nonce-reuse rejection fails closed, while a node that answers with the canonical hash for an already-known transaction returns a second valid Payment-Receipt for a single on-chain payment. This issue affects mpp: from 0.2.0 before 0.16.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS