CVE-2026-87119 Details
Description
Authentication Bypass by Capture-replay in ZenHive mpp allows an attacker holding a captured subscription activation credential to charge the payer repeatedly. The payer signs a Tempo KeyAuthorization over the chain id, key type, key id, expiry, limits and scopes only, with nothing tying it to the challenge that prompted it. MPP.Methods.Tempo.KeyAuthorization.verify/3 in lib/mpp/methods/tempo/key_authorization.ex pins each of those signed fields against the subscription request, and the access key it pins is a static per-endpoint server key, so one signed authorization verifies against every challenge the server issues for the same subscription terms. MPP.Methods.Tempo.Subscription.activate/4 deduplicates activations by challenge id, so presenting the captured credential under a fresh challenge produces a different dedup key, claim_activation succeeds, and the subscription transaction is built and broadcast again. Each replay charges the payer's wallet a new first-period settlement and re-authorizes the server key, bounded only by the subscription expiry and the chain's own semantics for re-installing an existing key. This issue affects mpp: from 0.14.0 before 0.16.2.
A vulnerability allowing authentication bypass via capture-replay has been identified in ZenHive mpp versions 0.14.0 prior to 0.16.2. This issue arises because the Tempo subscription key authorization is not tied to the specific challenge that prompted it. As a result, an attacker can reuse a captured activation credential to initiate repeated charges to the payer's wallet. The vulnerability exploits the fact that the authorization verification process uses a static server key for each subscription, allowing a single signed authorization to be valid for multiple challenges. The issue is further compounded by the absence of proper binding for witness-bearing authorizations, which are now rejected by the current mppx clients.
Users can update to ZenHive mpp version 0.16.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 22, 2026CISA-ADP
Assessed Sep 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.erlef.org/cves/CVE-2026-87119.html | EEF | AdvisoryRemedy |
| https://github.com/ZenHive/mpp/commit/4b6eaec02af0e8485cfb4ff68f467d075ed5dd6f | EEF | Source CodeVendor |
| https://github.com/ZenHive/mpp/commit/db464dfa9a86ccda58f0827101f6da6bd8aafa78 | EEF | Source CodeVendor |
| https://github.com/ZenHive/mpp/security/advisories/GHSA-p9fv-9w58-95x2 | EEF | AdvisoryRemedy |
| https://osv.dev/vulnerability/EEF-CVE-2026-87119 | EEF | AdvisoryTechnical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-294 | Authentication Bypass by Capture-replay | EEF |
Affected Products
| Product | Versions |
|---|---|
| ZenHive mpp | >= 0.14.0, < 0.16.2 (semver) ~0.14 ~0.15 ~0.16 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 22, 2026 | CVE Modified | CISA-ADP |
| Sep 22, 2026 | New CVE Received | EEF |