CVE-2026-89420 Details
Description
Improper Validation of Specified Quantity in Input in ZenHive mpp allows a client holding an open payment channel to obtain paid resources without being charged. MPP.Session.Actions.accept_voucher/3 in lib/mpp/session/actions.ex treats a voucher whose cumulativeAmount equals the channel's already-accepted cumulative amount as an idempotent success, returning the channel unchanged without calling maybe_spend/2. The credential verifies, the protected resource is served, and spent and units stay where they were. Because the server issues a fresh challenge per request and the credential replay store keys on challenge id and payload, the same signed voucher can be re-presented under every new challenge, so one paid voucher yields an unbounded number of paid units. The path is reachable from any method built on MPP.Session.Method through the Plug, MCP, JSON-RPC and WebSocket transports. This issue affects mpp: from 0.14.0 before 0.16.2.
A vulnerability in ZenHive mpp versions 0.14.0 prior to 0.16.2 allows clients with open payment channels to receive paid resources without being charged. The issue arises in the 'accept_voucher' function, where vouchers with cumulative amounts equal to the channel's already-accepted amounts are incorrectly treated as successful, without updating the channel state or calling the necessary spend function. This flaw enables the same signed voucher to be reused under different challenges, resulting in an unlimited supply of free resources. The vulnerability can be exploited through various transports, including Plug, MCP, JSON-RPC, and WebSocket.
Users can update to ZenHive mpp version 0.16.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 22, 2026CISA-ADP
Assessed Sep 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ZenHive/mpp/security/advisories/GHSA-8c63-r789-xrrf | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://cna.erlef.org/cves/CVE-2026-89420.html | EEF | AdvisoryBundle |
| https://github.com/ZenHive/mpp/commit/7270edc1dcfb58250cc5ee812876609206564165 | EEF | Source CodeVendor |
| https://github.com/ZenHive/mpp/commit/82df569c898be1137189e3648e1edb4af6363651 | EEF | Source CodeVendor |
| https://github.com/ZenHive/mpp/security/advisories/GHSA-8c63-r789-xrrf | EEF | AdvisoryExploitRemedyVendor |
| https://osv.dev/vulnerability/EEF-CVE-2026-89420 | EEF | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1284 | Improper Validation of Specified Quantity in Input | EEF |
Affected Products
| Product | Versions |
|---|---|
| ZenHive mpp | >= 0.14.0, < 0.16.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 22, 2026 | CVE Modified | CISA-ADP |
| Sep 22, 2026 | New CVE Received | EEF |