CVE-2026-73136

Name of the Vulnerable Software and Affected Versions ZenHive mpp versions 0.6.1 through 0.6.3

Description An authentication bypass exists via capture-replay that allows an unauthenticated third party to obtain paid resources by replaying a transfer settled by another payer. In the MPP.Methods.Tempo method, a settled TIP-20 TransferWithMemo is typically bound to a specific challenge using an attribution nonce in the memo. However, when a static memo is configured in method config, the check matched memo binding/3 function returns a match unconditionally, skipping the binding process. This leaves only the token, recipient, amount, and static memo value for verification. Since the static memo is included in unauthenticated 402 responses and Tempo transfers are public, an attacker can use a transaction hash from a legitimate customer's transfer as a type="hash" credential for a new challenge. The hash path does not perform sender or signature checks to verify if the presenter owns the wallet that broadcast the transfer.

Recommendations Update ZenHive mpp to version 0.6.4 or later. Avoid configuring a static memo in method config to ensure per-challenge attribution binding remains active.