Is CVE-2026-89420 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-89420 being exploited in the wild.

How severe is CVE-2026-89420?

Informational severity, published 22 September 2026.

Which products and versions are affected?

ZenHive Mpp 0.14.0 to before 0.16.2.

Is there a fix for CVE-2026-89420?

A patch was published on 2026: Fixed in version 0.16.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-89420 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-89420?

Check whether you run ZenHive Mpp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-89420: ZenHive mpp authorization bypass in payment channel validation

CVE-2026-89420 · Severity: info · Published 2026-09-22

ZenHive mpp is a library that manages micropayment channels, allowing clients to pay for resources. A validation flaw in the payment processing logic allows an attacker with an open payment channel to reuse a single paid voucher multiple times, obtaining unlimited resources without additional charges. This effectively provides free access to paid services to any authenticated channel holder.

Technologies: ZenHive Mpp. Vendors: ZenHive.

Quick answers

Is CVE-2026-89420 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-89420 being exploited in the wild.
How severe is CVE-2026-89420?: Informational severity, published 22 September 2026.
Which products and versions are affected?: ZenHive Mpp 0.14.0 to before 0.16.2.
Is there a fix for CVE-2026-89420?: A patch was published on 2026: Fixed in version 0.16.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-89420 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-89420?: Check whether you run ZenHive Mpp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an improper input validation flaw in MPP.Session.Actions.accept_voucher/3 (lib/mpp/session/actions.ex). When a voucher's cumulativeAmount matches the channel's already-accepted cumulative amount, the function incorrectly treats this as idempotent success and skips the spending validation via maybe_spend/2. Since the server issues a fresh challenge per request but the credential replay store keys only on challenge ID and payload, an attacker can replay the same signed voucher indefinitely across multiple requests. The vulnerability is reachable through all MPP transports (Plug, MCP, JSON-RPC, WebSocket) and affects any method built on MPP.Session.Method.

Affected products

ZenHive mpp 0.14.0 to before 0.16.2

Timeline

2026-09-22: disclosed
2026: patched: Fixed in version 0.16.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.