CVE-2026-73136highCWE-294

CVE-2026-73136: high-severity vulnerability in ZenHive mpp

Static memo configuration in mpp Tempo disables per-challenge attribution binding, enabling third-party replay

Published

Follow this CVE+ Monitor mpp+ Monitor mpp

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.2epss 0.6%
Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated third party to obtain paid resources by replaying a transfer settled by an unrelated payer. MPP.Methods.Tempo normally binds a settled TIP-20 TransferWithMemo to the specific challenge under verification through an attribution nonce carried in the memo. When a static "memo" is configured in method_config, check_matched_memo_binding/3 returns the match unconditionally and that binding is skipped, leaving only token, recipient, amount and the static memo value to match on. The static memo is echoed in every unauthenticated 402 response and Tempo transfers are public, so an attacker can take any matching transfer paid by a legitimate customer, request a fresh challenge for the same route, and present that transaction hash as a type="hash" credential. The hash path performs no sender or signature check tying the presenter to the wallet that broadcast the transfer. This issue affects mpp: from 0.6.1 before 0.6.4.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
ZenHive · mpp
Related CVEs — ZenHive mpp

In the same product, most dangerous first.

CVE-2026-67581HIGHOn-chain transfer proof is not single-use in mpp EVM payment method, enabling cross-challenge replayEPSS 0.6%CVE-2026-73541HIGHTempo fee sponsorship in mpp bounds each transaction but not aggregate exposure, allowing concurrent sponsor-wallet drainEPSS 0.6%CVE-2026-87119HIGHmpp Tempo subscription key authorization is not bound to the issuing challenge, allowing a captured activation credential to be replayedEPSS 0.6%CVE-2026-88255MEDIUMmpp Tempo keys its pre-broadcast dedup reserve on the caller-supplied transaction encoding, so a re-encoded signed transaction reserves a second slotEPSS 0.5%CVE-2026-89186MEDIUMmpp writes Payment-Receipt and Cache-Control before the wrapped application runs, letting a consumer's own Cache-Control expose paid responses to shared cachesEPSS 0.5%CVE-2026-82750HIGHUnbounded EIP-7702 authorization list in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors account delegationEPSS 0.5%