CVE-2026-82750 Details
Description
Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored payment by a large multiplier and to have the sponsor pay for EIP-7702 account delegations of the client's choosing. When the server sponsors Tempo payments, MPP.Methods.Tempo.FeePayerPolicy.measure/3 in lib/mpp/methods/tempo/fee_payer_policy.ex bounds the gas fields, the fee budget, the validity window and the access list of the client-signed 0x76 envelope, but never reads its aa_authorization_list field. Every signed delegation in that list is charged as intrinsic gas before the payment call runs, so a client attaching delegations from throwaway authority keys makes the sponsor pay for them within the default gas_limit ceiling. At the reporter's default of seven entries the sponsored cost rises from about 46,575 gas to about 1,884,087 gas. Because each entry is applied as a persistent set-code delegation, a client can also upgrade its own accounts to delegated code at the sponsor's expense. This issue affects mpp: from 0.2.0 before 0.16.1.
A vulnerability in ZenHive mpp's Tempo fee-payer sponsorship feature allows an unauthenticated remote client to significantly inflate the gas costs paid by the fee-payer for sponsored transactions. This issue arises from improper validation of the EIP-7702 authorization list in the client's transaction envelope. When the server sponsors Tempo payments, it correctly bounds most gas-related fields but fails to account for delegations specified in the authorization list. As a result, a client can attach multiple delegations from disposable authority keys, causing the sponsor to bear the cost of these entries as intrinsic gas charges. This exploitation can lead to a dramatic increase in the sponsor's gas expenses, effectively transferring the cost of unauthorized delegations to them. Additionally, the vulnerability allows clients to upgrade their own accounts to delegated code at the sponsor's expense, with potential implications for future transactions.
The vulnerability has been patched in ZenHive mpp version 0.16.1. Users should update to this version. For those who cannot update, Tempo fee sponsorship can be disabled or adjusted to limit gas inflation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 6, 2026CISA-ADP
Assessed Sep 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.erlef.org/cves/CVE-2026-82750.html | EEF | AdvisoryBundle |
| https://github.com/ZenHive/mpp/commit/0482572b47e1ffe1537ab80ab613d47b92833c2d | EEF | Source CodeVendor |
| https://github.com/ZenHive/mpp/security/advisories/GHSA-5qrp-r24c-w6jr | EEF | AdvisoryRemedyVendor |
| https://osv.dev/vulnerability/EEF-CVE-2026-82750 | EEF | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1284 | Improper Validation of Specified Quantity in Input | EEF |
Affected Products
| Product | Versions |
|---|---|
| ZenHive mpp | >= 0.2.0, < 0.16.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | CVE Modified | CISA-ADP |
| Sep 6, 2026 | New CVE Received | EEF |