CVE-2026-87119
Received Received - Intake

Authentication Bypass by Capture-replay in ZenHive mpp

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: EEF

Description
Authentication Bypass by Capture-replay in ZenHive mpp allows an attacker holding a captured subscription activation credential to charge the payer repeatedly. The payer signs a Tempo KeyAuthorization over the chain id, key type, key id, expiry, limits and scopes only, with nothing tying it to the challenge that prompted it. MPP.Methods.Tempo.KeyAuthorization.verify/3 in lib/mpp/methods/tempo/key_authorization.ex pins each of those signed fields against the subscription request, and the access key it pins is a static per-endpoint server key, so one signed authorization verifies against every challenge the server issues for the same subscription terms. MPP.Methods.Tempo.Subscription.activate/4 deduplicates activations by challenge id, so presenting the captured credential under a fresh challenge produces a different dedup key, claim_activation succeeds, and the subscription transaction is built and broadcast again. Each replay charges the payer's wallet a new first-period settlement and re-authorizes the server key, bounded only by the subscription expiry and the chain's own semantics for re-installing an existing key. This issue affects mpp: from 0.14.0 before 0.16.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-87119
EUVD
EUVD-2026-84361

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
zenhive mpp From 0.14.0 (inc) to 0.16.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-294 A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Authentication Bypass by Capture-replay in ZenHive's mpp software. It allows an attacker who captures a payer's subscription activation credential to repeatedly charge the payer by replaying the credential under new challenges. The issue occurs because the authorization is not tied to the specific challenge that prompted it, enabling the same signed credential to verify against multiple challenges for the same subscription terms.

Detection Guidance

Detecting this vulnerability requires checking if your ZenHive mpp version is between 0.14.0 and 0.16.1. Use commands like 'mpp --version' or check your package manager for installed versions. Monitor network traffic for repeated subscription activations with the same credentials under different challenges.

Impact Analysis

If you are a payer using ZenHive mpp versions 0.14.0 to 0.16.1, an attacker could capture your subscription activation credential and repeatedly charge your wallet. Each replay creates a new charge, limited only by your subscription expiry and the system's semantics. This could lead to unauthorized financial losses or drained funds.

Compliance Impact

This vulnerability could lead to unauthorized financial transactions, which may violate data protection and financial regulations. GDPR requires secure handling of personal data, and unauthorized transactions could indicate a breach of security obligations. HIPAA focuses on protecting financial data in healthcare, and repeated unauthorized charges could result in non-compliance with safeguard requirements.

Mitigation Strategies

Upgrade ZenHive mpp to version 0.16.2 or later to address the authentication bypass issue. Ensure Tempo subscription key authorizations are bound to specific challenges by verifying the witness field includes the challenge ID. Review and update client-side providers to include challenge IDs in wallet parameters and verification calls.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-87119. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart