Read the docs
TI-2026-47746 Aliases CVE-2026-67581GHSA-vrg5-xm7q-qcjh

On-chain transfer proof is not single-use in mpp EVM payment method, enabling cross-challenge replay

Priority MEDIUM 45CWE-294Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-294.

Summary

Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated remote client to obtain paid resources by resubmitting one settled on-chain transfer. MPP.Methods.EVM.verify/2 accepts a transaction-hash credential and matches a transfer purely on token, to and amount (ERC-20) or to and value (native). It binds the proof neither to the challenge being verified nor to any record of prior use, and the generic MPP.Plug dedup store keys on challenge.id, which is regenerated for every 402 response. On a static-price route, a single historical transfer matching the charge therefore satisfies an unbounded number of later charges, including transfers an attacker can read off a public block explorer. This issue affects mpp: from 0.3.0 before 0.6.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00595 48th percentileScored 2026-11-07
Fix Fixed mpp (ZenHive): 0.6.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ZenHivempp0.3.0 to before 0.6.30.6.3Patch availableCNA
  • mpp VendorZenHive Affected 0.3.0 to before 0.6.3 Fixed in 0.6.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:zenhive:machine_payments_protocol:*:*:*:*:*:elixir:*:*0.3.0 to before 0.6.4VulnerableZenHive
  • cpe:2.3:a:zenhive:machine_payments_protocol:*:*:*:*:*:elixir:*:* Versions 0.3.0 to before 0.6.4 Vulnerable ·ZenHive

Remediation

  • Fix · CNA mpp (ZenHive) Fixed in 0.6.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-67581
  2. 2026-10-03 Alias added: GHSA-vrg5-xm7q-qcjh

References

Patch 1

Advisory 3

  • TI-2026-51635 Resource allocation without limits in ZenHive mpp CVSS 4.0HIGH 8.3
  • TI-2026-51302 Static memo configuration in mpp Tempo disables per-challenge attribution binding, enabling third-party replay CVSS 4.0HIGH 8.2
  • TI-2026-51860 Non-atomic hash-credential dedup in mpp Tempo allows replay of a confirmed payment under a concurrent race CVSS 4.0MEDIUM 6.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences