# CVE-2026-67581: ZenHive mpp authentication bypass in EVM payment verification

Source: https://junglewise.ai/threats/cve-2026-67581-zenhive-mpp-authentication-bypass-in-evm-payment-verification  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-67581 · Severity: high · CVSS 7.5 · Published 2026-08-19

ZenHive mpp is a blockchain-based payment processing library used to verify and authenticate transactions. An unauthenticated attacker can bypass payment verification by replaying previously confirmed blockchain transfers, allowing them to obtain paid services or resources without actually making new payments.

Technologies: [ZenHive Machine Payments Protocol](https://junglewise.ai/threats/technologies/machine-payments-protocol), [ZenHive Mpp](https://junglewise.ai/threats/technologies/mpp). Vendors: [ZenHive](https://junglewise.ai/threats/vendors/zenhive).

## Quick answers

**Is CVE-2026-67581 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67581 being exploited in the wild.

**How severe is CVE-2026-67581?** High severity, with a CVSS score of 7.5, published 19 August 2026.

**Which products and versions are affected?** ZenHive Mpp 0.3.0 to before 0.6.3.

**Is there a fix for CVE-2026-67581?** A patch was published on 2026-08-19: Fixed in version 0.6.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-67581 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-67581?** Check whether you run ZenHive Machine Payments Protocol or ZenHive Mpp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a replay attack in the MPP.Methods.EVM.verify/2 function, which verifies payment proofs based on blockchain transaction hashes. The verification logic matches transfers solely on token, recipient address, and amount without binding the proof to the specific payment challenge or recording prior use. Additionally, the deduplication store keys on challenge.id, which is regenerated for every 402 response, allowing a single historical transfer from a public blockchain to satisfy multiple future payment charges. An attacker can read historical transfers from a public block explorer and replay them to gain unauthorized access to paid resources. This affects all versions from 0.3.0 before 0.6.3; a patch is available in 0.6.3 or later.

## Affected products

- ZenHive mpp 0.3.0 to before 0.6.3

## Timeline

- 2026-08-19: disclosed
- 2026-08-19: patched: Fixed in version 0.6.3

## References

- [https://repo.hex.pm/](https://repo.hex.pm/)
- [https://github.com/](https://github.com/)

## Related threats

- [mpp gas limit validation failure in broadcast_and_verify](https://junglewise.ai/threats/mpp-vulnerable-to-gas-draining-with-low-gas-limit-9a9ae054)
- [ZenHive mpp input validation bypass in fee-payer cosigning](https://junglewise.ai/threats/mpp-vulnerable-to-gas-draining-with-no-limit-9bf9cd33)
- [ZenHive mpp authorization bypass in payment channel validation](https://junglewise.ai/threats/cve-2026-89420-improper-validation-of-specified-quantity-in-input-in-zenhive-mpp)
- [ZenHive mpp authentication bypass in subscription activation](https://junglewise.ai/threats/cve-2026-87119-authentication-bypass-by-capture-replay-in-zenhive-mpp-allows-an)
- [ZenHive mpp HTTP cache header override vulnerability](https://junglewise.ai/threats/cve-2026-89186-zenhive-mpp-http-cache-header-override-vulnerability)