CVE-2026-89420
Received Received - Intake

Improper Voucher Validation in ZenHive mpp Allows Resource Exploitation

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: EEF

Description
Improper Validation of Specified Quantity in Input in ZenHive mpp allows a client holding an open payment channel to obtain paid resources without being charged. MPP.Session.Actions.accept_voucher/3 in lib/mpp/session/actions.ex treats a voucher whose cumulativeAmount equals the channel's already-accepted cumulative amount as an idempotent success, returning the channel unchanged without calling maybe_spend/2. The credential verifies, the protected resource is served, and spent and units stay where they were. Because the server issues a fresh challenge per request and the credential replay store keys on challenge id and payload, the same signed voucher can be re-presented under every new challenge, so one paid voucher yields an unbounded number of paid units. The path is reachable from any method built on MPP.Session.Method through the Plug, MCP, JSON-RPC and WebSocket transports. This issue affects mpp: from 0.14.0 before 0.16.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-89420
EUVD
EUVD-2026-84360

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
zenhive mpp From 0.14.0 (inc) to 0.16.2 (exc)
zenhive mpp to 0.16.2 (exc)
mpp mpp From 0.14.0 (inc) to 0.16.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1284 The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in ZenHive's mpp software allows a client with an open payment channel to reuse a single paid voucher indefinitely without additional charges. The system incorrectly treats vouchers with the same cumulative amount as valid without updating the channel state or recording usage. This occurs because the accept_voucher/3 function in lib/mpp/session/actions.ex returns a success without verifying or spending funds when the cumulative amount matches the channel's accepted amount.

Detection Guidance

To detect this vulnerability, check if your mpp version is between 0.14.0 and 0.16.1. Run: mpp --version. Inspect session logs for repeated voucher acceptance without spending updates. Monitor for unusual resource access patterns where cumulative voucher amounts do not increase.

Impact Analysis

If you operate mpp as paid-API middleware, this vulnerability could cause revenue loss proportional to client consumption. Attackers can exploit it to receive unlimited free service units without paying by reusing a single paid voucher under new challenges. The impact includes financial discrepancies and potential memory exhaustion from repeated requests.

Compliance Impact

The vulnerability allows unauthorized reuse of paid vouchers for unlimited service access without additional payment, which could lead to unauthorized data access or processing. This may violate GDPR principles of lawful processing and data integrity, as well as HIPAA requirements for access controls and audit trails if patient data is involved.

Mitigation Strategies

Update the mpp software to version 0.16.2 or later to address the vulnerability. Review session voucher handling logs for unusual reuse of vouchers with identical cumulative amounts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89420. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart