CVE-2026-82751

Name of the Vulnerable Software and Affected Versions ZenHive mpp versions 0.2.0 through 0.16.0

Description Improper validation of input quantities allows an unauthenticated remote client to significantly increase the gas cost for a sponsor during sponsored payments. The issue occurs when the server sponsors Tempo payments via the MPP.Methods.Tempo.FeePayerPolicy.measure/3 function in lib/mpp/methods/tempo/fee payer policy.ex. While the function bounds gas fields, fee budgets, validity windows, and access lists of the client-signed 0x76 envelope, it fails to check for the optional key authorization field. An attacker can attach a signed key authorization to a payment call to provision a new access key with token spending limits on their own account. These operations are billed as intrinsic gas to the sponsor, potentially increasing the cost from approximately 46,587 gas to 1,808,700 gas per payment.

Recommendations Update ZenHive mpp to version 0.16.1 or later. Disable Tempo fee sponsorship by setting fee payer to false and removing the fee payer url so clients pay their own gas. Lower the max gas override in fee payer policy to a value slightly above a legitimate sponsored payment (approximately 50,000 gas for a TIP-20 transfer) to limit the potential gas inflation.