CVE-2026-73829

Name of the Vulnerable Software and Affected Versions ZenHive mpp versions 0.2.0 through 0.6.0

Description A Time-of-check Time-of-use (TOCTOU) race condition exists, allowing an unauthenticated remote client to redeem a single confirmed on-chain payment for multiple paid-resource accesses. This occurs in the type="hash" credential path within the MPP.Methods.Tempo.verify/2 function, which uses a non-atomic check-then-mark sequence. Specifically, the check hash unused/2 function reads the deduplication store, and after an eth getTransactionReceipt round trip verifies the payment on-chain, the mark hash used/2 function writes the mark. Concurrent requests using the same settled payment hash can pass the initial read before any write occurs, resulting in multiple receipts. While an atomic check and mark/2 primitive exists and is used by the type="transaction" path, the hash path incorrectly uses plain get and put operations. This issue requires a deduplication store to be configured, as the default nil store is stateless and provides no replay protection.

Recommendations Update ZenHive mpp to version 0.6.1. As a temporary mitigation, restrict the use of the type="hash" credential path in MPP.Methods.Tempo.verify/2 until the update is applied.