Intel

CVE-2026-73136

mpp: Authentication Bypass by Capture-replay (CVE-2026-73136)

highEPSS 0.6%

Affected

  • hex/mpp 0.6.1..*
  • hex/mpp 0.6.2..*
  • hex/mpp 0.6.3..*

Description

Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated third party to obtain paid resources by replaying a transfer settled by an unrelated payer. MPP.Methods.Tempo normally binds a settled TIP-20 TransferWithMemo to the specific challenge under verification through an attribution nonce carried in the memo. When a static "memo" is configured in method_config, check_matched_memo_binding/3 returns the match unconditionally and that binding is skipped, leaving only token, recipient, amount and the static memo value to match on. The static memo is echoed in every unauthenticated 402 response and Tempo transfers are public, so an attacker can take any matching transfer paid by a legitimate customer, request a fresh challenge for the same route, and present that transaction hash as a type="hash" credential. The hash path performs no sender or signature check tying the presenter to the wallet that broadcast the transfer. This issue affects mpp: from 0.6.1 before 0.6.4.

Source: OSV (Open Source Vulnerabilities)NVD (NIST)cvelistv5CVE.org (MITRE)

Affected products

The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

hexmpp
0.6.10.6.20.6.3

Metrics

XIEM Effective CVSS
8.2
Source: cna-v4
EPSS percentile
46.9 %
High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
KEV status
—
Show all metrics
Severity
high
Priority score
84.63
Exploit maturity
no public PoC known
CVSS v3
7.5
CVSS v4
8.2
EPSS score
0.6 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-08-19 18:17 UTC
CWE
CWE-294

Weakness classes (CWE)

  • CWE-294Base

    Authentication Bypass by Capture-replay

    A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

    cwe.mitre.org →

References & sources

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. Initial Analysis2026-09-10 18:17 UTC· nvd@nist.gov
    • CVSS V3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
    • CPE Configuration: OR *cpe:2.3:a:zenhive:machine_payments_protocol:*:*:*:*:*:elixir:*:* versions from (including) 0.6.1 up to (excluding) 0.6.4
    • Reference Type: EEF: https://cna.erlef.org/cves/CVE-2026-73136.html Types: Third Party Advisory
    • Reference Type: EEF: https://github.com/ZenHive/mpp/commit/2207d7f456ae14c1d3fcacc6f635bf4f8cee1a34 Types: Patch
  2. New CVE Received2026-08-19 18:17 UTC· 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
    • Affected: mpp, mpp
    • Description: Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated third party to obtain paid resources by replaying a transfer settled by an unrelated payer. MPP.Methods.Tempo normally binds a settled TIP-20 TransferWithMemo to the specific challenge under verification through an attribution nonce carried in the memo. When a static "memo" is configured in method_config, check_matched_memo_binding/3 returns the match unconditionally and that binding is skipped, leaving only token, recipient, amount and the static memo value to match on. The static memo is echoed in every unauthenticated 402 response and Tempo transfers are public, so an attacker can take any matching transfer paid by a legitimate customer, request a fresh challenge for the same route, and present that transaction hash as a type="hash" credential. The hash path performs no sender or signature check tying the presenter to the wallet that broadcast the transfer. This issue affects mpp: from 0.6.1 before 0.6.4.
    • CVSS V4.0: AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
    • CWE: CWE-294