CVE-2026-34210mediumCWE-697

CVE-2026-34210: falha de média gravidade em wevm mppx

mppx has Stripe charge credential replay via missing idempotency check

Publicada em

Seguir esta CVE+ Monitorar mppx+ Monitorar mppx

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6epss 0.5%
mppx is a TypeScript interface for machine payments protocol. Prior to version 0.4.11, the stripe/charge payment method did not check Stripe's Idempotent-Replayed response header when creating PaymentIntents. An attacker could replay a valid credential containing the same spt token against a new challenge, and the server would accept the replayed Stripe PaymentIntent as a new successful payment without actually charging the customer again. This allowed an attacker to pay once and consume unlimited resources by replaying the credential. This issue has been patched in version 0.4.11.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
wevm · mppx
CVEs relacionadas — wevm mppx

No mesmo produto, das mais perigosas para as menos.

CVE-2026-63627MEDIUMmppx: Gas Draining with paddingEPSS 0.5%CVE-2026-63628MEDIUMmppx: Gas Draining with access listEPSS 0.5%CVE-2026-34209HIGHmppx: Tempo has a session close voucher bypass vulnerability due to settled amount equalityEPSS 0.4%