CVE-2026-34209
mppx: Tempo has a session close voucher bypass vulnerability due to settled amount equality
- State
- Published
- Severity
- 7.5 High
- Published
- Mar 31, 2026
- Updated
- Apr 2, 2026
- Reserved
- Mar 26, 2026
Description
mppx is a TypeScript interface for machine payments protocol. Prior to version 0.4.11, the tempo/session cooperative close handler validated the close voucher amount using "<" instead of "<=" against the on-chain settled amount. An attacker could submit a close voucher exactly equal to the settled amount, which would be accepted without committing any new funds, effectively closing or griefing the channel for free. This issue has been patched in version 0.4.11.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | GitHub_M |
Weaknesses
- CWE-294 Authentication Bypass by Capture-replay
Affected Products
| Product | Versions |
|---|---|
mppxwevm |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.