CVE-2026-82751 Details
Description
Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored payment by a large multiplier and to have the sponsor pay for provisioning an access key on the client's own account. When the server sponsors Tempo payments, MPP.Methods.Tempo.FeePayerPolicy.measure/3 in lib/mpp/methods/tempo/fee_payer_policy.ex bounds the gas fields, the fee budget, the validity window and the access list of the client-signed 0x76 envelope, but does not check whether the envelope carries the optional key_authorization field. A client can attach a fully signed key authorization, provisioning a new access key with token spending limits on its own account, alongside the normal payment call. The key and each limit entry are persistent storage writes billed as intrinsic gas to the sponsor, bounded only by the gas_limit ceiling. At the reporter's default of one key with three token limits the sponsored cost rises from about 46,587 gas to about 1,808,700 gas, and the client keeps a valid access key it paid nothing for. This issue affects mpp: from 0.2.0 before 0.16.1.
A vulnerability in ZenHive's mpp library, specifically in versions 0.2.0 prior to 0.16.1, allows an unauthenticated remote client to improperly validate input quantities. This flaw enables the client to significantly inflate the gas costs for the fee-payer during sponsored payments, while also provisioning a new access key on the client's account at no cost. The issue arises because the server's fee-payer sponsorship process fails to check the optional key authorization field in the transaction envelope. As a result, a client can attach a signed key authorization, creating a new access key with token spending limits, alongside a regular payment. This exploitation leads to a dramatic increase in the gas fees paid by the sponsor, with the client benefiting from a valid access key without any expense.
Users can disable Tempo fee sponsorship by leaving the 'fee_payer' setting at its default of false and not specifying a 'fee_payer_url'. If sponsorship must remain enabled, the 'max_gas' override in the 'fee_payer_policy' can be adjusted to just above the gas required for a legitimate sponsored payment, thereby preventing the exploitation of this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 6, 2026CISA-ADP
Assessed Sep 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.erlef.org/cves/CVE-2026-82751.html | EEF | AdvisoryBundleRemedy |
| https://github.com/ZenHive/mpp/commit/0482572b47e1ffe1537ab80ab613d47b92833c2d | EEF | Source CodeVendor |
| https://github.com/ZenHive/mpp/security/advisories/GHSA-rpwj-vrf7-4x36 | EEF | AdvisoryExploitRemedyVendor |
| https://osv.dev/vulnerability/EEF-CVE-2026-82751 | EEF | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1284 | Improper Validation of Specified Quantity in Input | EEF |
Affected Products
| Product | Versions |
|---|---|
| ZenHive mpp | >= 0.2.0, < 0.16.1 (semver) <= 0.16.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | CVE Modified | CISA-ADP |
| Sep 6, 2026 | New CVE Received | EEF |