CVE-2026-73829
Received Received - Intake

Race Condition in ZenHive mpp Allows Payment Replay

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: EEF

Description
Time-of-check Time-of-use (TOCTOU) Race Condition in ZenHive mpp allows an unauthenticated remote client to redeem one confirmed on-chain payment for multiple paid-resource accesses. The type="hash" credential path in MPP.Methods.Tempo.verify/2 guards against replay with a non-atomic check-then-mark sequence: check_hash_unused/2 reads the dedup store, an eth_getTransactionReceipt round trip verifies the payment on chain, and only then does mark_hash_used/2 write the mark. Concurrent requests carrying the same settled payment hash all pass the read before any of them writes, so each is issued a receipt. The store's atomic check_and_mark/2 primitive is available and used by the type="transaction" path, but the hash path calls plain get and put even when the configured store implements it. Exploitation requires a dedup store to be configured; the default nil store is stateless and documented as offering no replay protection at all. This issue affects mpp: from 0.2.0 before 0.6.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-73829
EUVD
EUVD-2026-62591

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
zenhive mpp From 0.2.0 (inc) to 0.6.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-367 The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Time-of-Check Time-of-Use (TOCTOU) race condition in ZenHive's mpp library. It allows an unauthenticated remote attacker to exploit a non-atomic check-then-mark sequence for hash-based credentials. A single confirmed on-chain payment can be replayed multiple times to gain repeated access to paid resources. The vulnerability occurs because the verification process checks if a payment hash is unused, verifies the payment on-chain, then marks it as used, but these steps are not atomic. Concurrent requests with the same payment hash can all pass the initial check before any write the mark, allowing each to receive a receipt.

Detection Guidance

Detecting this vulnerability requires checking for concurrent requests exploiting the TOCTOU race condition in ZenHive mpp versions <= 0.6.0. Monitor logs for multiple successful verifications of the same payment hash within a short timeframe. Use network traffic analysis to identify duplicate requests with identical on-chain payment hashes being processed simultaneously.

Impact Analysis

An attacker could exploit this to redeem a single confirmed payment for multiple resource accesses, effectively bypassing payment controls. This could lead to unauthorized access to paid services or resources, financial loss for service providers, and potential misuse of system resources. The impact depends on whether a dedup store is configured, as the default stateless mode offers no replay protection.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized access to paid resources through replayed payments. GDPR requires data protection and access controls, while HIPAA mandates secure handling of sensitive data. The flaw allows multiple unauthorized accesses using a single payment, violating integrity and access control requirements in these standards.

Mitigation Strategies

Upgrade mpp to version 0.6.1 or later to apply the atomic check_and_mark fix. If using a custom dedup store, ensure it supports atomic operations. Disable hash-based credential verification if not required. Tighten network monitoring for duplicate payment hashes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73829. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart