Executive brief
ZenHive mpp is a library that handles subscription payments and key authorizations. An attacker with a captured subscription activation credential can replay it multiple times to charge a payer's wallet repeatedly without needing new authorization, potentially draining funds through repeated unauthorized transactions.
Technical details
A capture-replay vulnerability exists in MPP.Methods.Tempo.KeyAuthorization.verify/3 where signed authorization tokens lack challenge-binding; the same signature verifies against any server challenge with matching subscription terms. MPP.Methods.Tempo.Subscription.activate/4 deduplicates by challenge ID only, so a replayed credential with a fresh challenge bypasses deduplication, allowing repeated subscription transactions and wallet charges bounded only by expiry and chain semantics.
Affected products
- ZenHive mpp 0.14.0 to before 0.16.2
Timeline
- 2026-09-22: disclosed