CVE-2026-89420

Name of the Vulnerable Software and Affected Versions ZenHive mpp versions 0.14.0 through 0.16.1

Description Improper validation of the specified quantity in the input allows a client with an open payment channel to obtain paid resources without being charged. The function accept voucher/3 in lib/mpp/session/actions.ex treats a voucher where the cumulativeAmount equals the channel's already-accepted cumulative amount as an idempotent success. This results in the channel remaining unchanged without calling maybe spend/2, meaning the protected resource is served while spent and units variables remain static. Since the server issues a fresh challenge per request and the credential replay store keys on challenge ID and payload, a single signed voucher can be re-presented under every new challenge to obtain an unbounded number of paid units. This path is accessible via any method built on MPP.Session.Method through Plug, MCP, JSON-RPC, and WebSocket transports.

Recommendations Update ZenHive mpp to version 0.16.2.