Improper Validation of Specified Quantity in Input in ZenHive mpp allows a client holding an open payment channel to obtain paid resources without being charged. MPP.Session.Actions.accept_voucher/3…
Info
Summary
Improper Validation of Specified Quantity in Input in ZenHive mpp allows a client holding an open payment channel to obtain paid resources without being charged. MPP.Session.Actions.accept_voucher/3 in lib/mpp/session/actions.ex treats a voucher whose cumulativeAmount equals the channel's already-accepted cumulative amount as an idempotent success, returning the channel unchanged without calling maybe_spend/2. The credential verifies, the protected resource is served, and spent and units stay …
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://cna.erlef.org/cves/CVE-2026-89420.html
- https://github.com/ZenHive/mpp/commit/7270edc1dcfb58250cc5ee812876609206564165
- https://github.com/ZenHive/mpp/commit/82df569c898be1137189e3648e1edb4af6363651
- https://github.com/ZenHive/mpp/security/advisories/GHSA-8c63-r789-xrrf
- https://osv.dev/vulnerability/EEF-CVE-2026-89420
Timeline
- nvd_ingest NVD