CVE-2026-87119 in mpp
Summary
by MITRE • 09/22/2026
Authentication Bypass by Capture-replay in ZenHive mpp allows an attacker holding a captured subscription activation credential to charge the payer repeatedly.
The payer signs a Tempo KeyAuthorization over the chain id, key type, key id, expiry, limits and scopes only, with nothing tying it to the challenge that prompted it. MPP.Methods.Tempo.KeyAuthorization.verify/3 in lib/mpp/methods/tempo/key_authorization.ex pins each of those signed fields against the subscription request, and the access key it pins is a static per-endpoint server key, so one signed authorization verifies against every challenge the server issues for the same subscription terms. MPP.Methods.Tempo.Subscription.activate/4 deduplicates activations by challenge id, so presenting the captured credential under a fresh challenge produces a different dedup key, claim_activation succeeds, and the subscription transaction is built and broadcast again. Each replay charges the payer's wallet a new first-period settlement and re-authorizes the server key, bounded only by the subscription expiry and the chain's own semantics for re-installing an existing key.
This issue affects mpp: from 0.14.0 before 0.16.2.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in ZenHive MPP versions prior to 0.16.2 represents a critical authentication bypass facilitated by the capture and replay of subscription activation credentials. This flaw stems from a fundamental design error in how cryptographic signatures are generated and verified within the Tempo key authorization mechanism. Specifically, when a payer initiates a subscription, they sign a KeyAuthorization object that includes parameters such as chain ID, key type, key ID, expiry time, limits, and scopes. However, this signature does not incorporate any element of randomness or challenge-specific data from the server's request. Consequently, the resulting cryptographic proof is static relative to the specific transaction context it was intended for, allowing an attacker who intercepts a valid credential during transmission to reuse that exact signed payload against subsequent requests without needing access to private keys or additional authentication factors.
From a technical perspective, the root cause lies in the implementation of MPP.Methods.Tempo.KeyAuthorization.verify/3 within the lib/mpp/methods/tempo/key_authorization.ex module. This function validates incoming KeyAuthorization objects by pinning each signed field against the corresponding subscription request parameters and verifying them against a static per-endpoint server key. Because the signature lacks binding to a unique challenge or nonce issued by the server, any validly signed authorization for specific subscription terms will verify successfully regardless of when it is presented, provided the expiration date has not passed. This absence of replay protection means that the cryptographic integrity check confirms only that the payer authorized those specific terms at some point in time, but fails to confirm that this authorization was intended for the current activation attempt.
The operational impact of this vulnerability allows an attacker with network-level access or compromised session data to repeatedly charge a victim's wallet by re-submitting captured subscription activation credentials under fresh challenge IDs. The system employs deduplication logic based on challenge identifiers in MPP.Methods.Tempo.Subscription.activate/4, which means that presenting the same signed credential against a new challenge bypasses duplicate detection mechanisms. As a result, claim_activation succeeds for each replayed request, leading to the construction and broadcast of multiple subscription transactions. Each successful replay triggers a new first-period settlement charge against the payer's wallet and re-authorizes the server key, effectively draining funds until either the subscription expires or the chain enforces limits on reinstalling existing keys. This creates a direct financial loss vector for users relying on this authentication flow.
This issue aligns with CWE-287, which describes Improper Authentication, specifically highlighting failures in verifying identity due to insufficient challenge-response mechanisms. Furthermore, it relates to CWE-345 regarding Insufficient Verification of Data Authenticity, as the system fails to ensure that the authenticated data is bound to its specific context or session. In terms of offensive security frameworks, this vulnerability facilitates techniques associated with MITRE ATT&CK Tactic TA0001 Initial Access and TA0006 Credential Access, particularly through credential replay attacks where valid credentials are reused to gain unauthorized access or perform actions on behalf of the victim. The lack of unique session binding allows for automated exploitation scripts that can rapidly exhaust a user's available funds by continuously submitting captured payloads.
Mitigation strategies must focus on implementing robust challenge-response authentication protocols within the Tempo key authorization flow. Developers should ensure that every KeyAuthorization signature includes a server-generated nonce or timestamp that is cryptographically bound to the signed payload, ensuring uniqueness per request. Additionally, integrating session-specific identifiers into the signing process would prevent replay attacks by invalidating previous signatures once a new challenge is issued. Upgrading ZenHive MPP to version 0.16.2 or later resolves this issue as it addresses these cryptographic binding deficiencies. Until an upgrade can be performed, organizations should implement network-level monitoring for repeated identical signature patterns and consider adding rate limiting on subscription activation endpoints to detect and block potential replay attempts in real-time.