CVE-2026-67581

On-chain transfer proof is not single-use in mpp EVM payment method, enabling cross-challenge replay

State: Published
Severity: 8.7 High
Published: Aug 19, 2026
Updated: Aug 19, 2026
Reserved: Aug 18, 2026

Description

Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated remote client to obtain paid resources by resubmitting one settled on-chain transfer.

MPP.Methods.EVM.verify/2 accepts a transaction-hash credential and matches a transfer purely on token, to and amount (ERC-20) or to and value (native). It binds the proof neither to the challenge being verified nor to any record of prior use, and the generic MPP.Plug dedup store keys on challenge.id, which is regenerated for every 402 response. On a static-price route, a single historical transfer matching the charge therefore satisfies an unbounded number of later charges, including transfers an attacker can read off a public block explorer.

This issue affects mpp: from 0.3.0 before 0.6.3.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N	EEF

Weaknesses

CWE-294 Authentication Bypass by Capture-replay

Affected Products

Product	Versions
mppZenHive	0.3.0 to before 0.6.3Affected
mppZenHive	65b9e425ce27631c786a5b380b5e4c5ae607ec6d to before ecc038088b1cda09ad8a84acc6cc112addb4a68fAffected

References

https://github.com/ZenHive/mpp/security/advisories/GHSA-vp5h-xh25-44wfvendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-67581.htmlrelated
https://osv.dev/vulnerability/EEF-CVE-2026-67581related
https://github.com/ZenHive/mpp/commit/ecc038088b1cda09ad8a84acc6cc112addb4a68fpatch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.