CVE-2026-67581
Received Received - Intake

Authentication Bypass by Capture-replay in ZenHive mpp

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: EEF

Description
Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated remote client to obtain paid resources by resubmitting one settled on-chain transfer. MPP.Methods.EVM.verify/2 accepts a transaction-hash credential and matches a transfer purely on token, to and amount (ERC-20) or to and value (native). It binds the proof neither to the challenge being verified nor to any record of prior use, and the generic MPP.Plug dedup store keys on challenge.id, which is regenerated for every 402 response. On a static-price route, a single historical transfer matching the charge therefore satisfies an unbounded number of later charges, including transfers an attacker can read off a public block explorer. This issue affects mpp: from 0.3.0 before 0.6.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-67581
EUVD
EUVD-2026-62594

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
zenhive mpp From 0.3.0 (inc) to 0.6.3 (exc)
zenhive mpp to 0.6.3 (exc)
zenhive mpp to 0.6.2 (inc)
zenhive mpp 0.6.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-294 A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-67581 is an authentication bypass vulnerability in the ZenHive mpp library. It allows an unauthenticated remote attacker to bypass authentication and obtain paid resources by replaying a single settled on-chain transfer. The issue occurs in the EVM payment method's verification function, which does not bind transaction hashes to specific challenges or track prior use, enabling replay attacks.

Detection Guidance

Detecting this vulnerability requires checking if your ZenHive mpp library version is between 0.3.0 and 0.6.2. Run: grep -r 'mpp' your_project_path | grep version. If the version falls within this range, the system is vulnerable. Additionally, monitor for unusual payment replay patterns or multiple successful verifications from the same transaction hash.

Impact Analysis

An attacker could exploit this to reuse a single historical transfer for multiple charges, potentially obtaining unauthorized access to paid resources. This is especially risky on static-price routes where a single transfer could satisfy unlimited future charges. The impact includes financial loss and unauthorized resource access.

Compliance Impact

This vulnerability could lead to unauthorized access to paid resources, potentially violating data protection principles under GDPR (e.g., lawful processing, integrity) and HIPAA (e.g., unauthorized access to protected health information). The lack of single-use binding for transaction hashes may enable replay attacks, compromising secure authentication and payment verification.

Mitigation Strategies

Upgrade to mpp version 0.6.3 or later. If upgrading is not immediately possible, implement per-challenge unique pricing, shorten challenge expiry windows, or switch to the Tempo method for on-chain payments. Configure the optional store-based deduplication mechanism to enforce single-use transaction hashes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67581. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart