Vulnerability-Lookup

GHSA-96M7-5WFV-978M

Vulnerability from github – Published: 2026-09-22 12:30 – Updated: 2026-09-22 12:30

Details

Improper Validation of Specified Quantity in Input in ZenHive mpp allows a client holding an open payment channel to obtain paid resources without being charged.

MPP.Session.Actions.accept_voucher/3 in lib/mpp/session/actions.ex treats a voucher whose cumulativeAmount equals the channel's already-accepted cumulative amount as an idempotent success, returning the channel unchanged without calling maybe_spend/2. The credential verifies, the protected resource is served, and spent and units stay where they were. Because the server issues a fresh challenge per request and the credential replay store keys on challenge id and payload, the same signed voucher can be re-presented under every new challenge, so one paid voucher yields an unbounded number of paid units. The path is reachable from any method built on MPP.Session.Method through the Plug, MCP, JSON-RPC and WebSocket transports.

This issue affects mpp: from 0.14.0 before 0.16.2.

Severity

7.1 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-89420"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-22T12:17:14Z",
    "severity": "HIGH"
  },
  "details": "Improper Validation of Specified Quantity in Input in ZenHive mpp allows a client holding an open payment channel to obtain paid resources without being charged.\n\nMPP.Session.Actions.accept_voucher/3 in lib/mpp/session/actions.ex treats a voucher whose cumulativeAmount equals the channel\u0027s already-accepted cumulative amount as an idempotent success, returning the channel unchanged without calling maybe_spend/2. The credential verifies, the protected resource is served, and spent and units stay where they were. Because the server issues a fresh challenge per request and the credential replay store keys on challenge id and payload, the same signed voucher can be re-presented under every new challenge, so one paid voucher yields an unbounded number of paid units. The path is reachable from any method built on MPP.Session.Method through the Plug, MCP, JSON-RPC and WebSocket transports.\n\nThis issue affects mpp: from 0.14.0 before 0.16.2.",
  "id": "GHSA-96m7-5wfv-978m",
  "modified": "2026-09-22T12:30:26Z",
  "published": "2026-09-22T12:30:26Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ZenHive/mpp/security/advisories/GHSA-8c63-r789-xrrf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89420"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ZenHive/mpp/commit/7270edc1dcfb58250cc5ee812876609206564165"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ZenHive/mpp/commit/82df569c898be1137189e3648e1edb4af6363651"
    },
    {
      "type": "WEB",
      "url": "https://cna.erlef.org/cves/CVE-2026-89420.html"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-89420"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CVE-2026-89420 (GCVE-0-2026-89420)

Vulnerability from cvelistv5 – Published: 2026-09-22 11:16 – Updated: 2026-09-22 12:04

Title

Session voucher adding no new funds is accepted without a charge in mpp, serving paid resources for free

Summary

Improper Validation of Specified Quantity in Input in ZenHive mpp allows a client holding an open payment channel to obtain paid resources without being charged. MPP.Session.Actions.accept_voucher/3 in lib/mpp/session/actions.ex treats a voucher whose cumulativeAmount equals the channel's already-accepted cumulative amount as an idempotent success, returning the channel unchanged without calling maybe_spend/2. The credential verifies, the protected resource is served, and spent and units stay where they were. Because the server issues a fresh challenge per request and the credential replay store keys on challenge id and payload, the same signed voucher can be re-presented under every new challenge, so one paid voucher yields an unbounded number of paid units. The path is reachable from any method built on MPP.Session.Method through the Plug, MCP, JSON-RPC and WebSocket transports. This issue affects mpp: from 0.14.0 before 0.16.2.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-22 12:03 UTC

CWE

CWE-1284 - Improper Validation of Specified Quantity in Input

Assigner

EEF mitre root

References

5 references

URL	Tags
https://github.com/ZenHive/mpp/security/advisorie…	relatedvendor-advisory
https://cna.erlef.org/cves/CVE-2026-89420.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-89420	related
https://github.com/ZenHive/mpp/commit/82df569c898…	related
https://github.com/ZenHive/mpp/commit/7270edc1dcf…	patch

Impacted products

2 products

Vendor	Product	Version
ZenHive	mpp	Affected: 0.14.0 , < 0.16.2 (semver) cpe:2.3:a:ZenHive:mpp::::::::
ZenHive	mpp	Affected: 82df569c898be1137189e3648e1edb4af6363651 , < 7270edc1dcfb58250cc5ee812876609206564165 (git) cpe:2.3:a:ZenHive:mpp::::::::

Credits

E.FU E.FU Jonatan Männchen / EEF

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89420",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T12:03:58.968313Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T12:04:43.291Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/ZenHive/mpp/security/advisories/GHSA-8c63-r789-xrrf"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:ZenHive:mpp:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.MPP.Session.Actions\u0027"
          ],
          "packageName": "mpp",
          "packageURL": "pkg:hex/mpp",
          "product": "mpp",
          "programFiles": [
            "lib/mpp/session/actions.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.MPP.Session.Actions\u0027:dispatch/2"
            },
            {
              "name": "\u0027Elixir.MPP.Session.Actions\u0027:handle/2"
            }
          ],
          "repo": "https://github.com/ZenHive/mpp",
          "vendor": "ZenHive",
          "versions": [
            {
              "lessThan": "0.16.2",
              "status": "affected",
              "version": "0.14.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:ZenHive:mpp:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.MPP.Session.Actions\u0027"
          ],
          "packageName": "zenhive/mpp",
          "packageURL": "pkg:github/zenhive/mpp",
          "product": "mpp",
          "programFiles": [
            "lib/mpp/session/actions.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.MPP.Session.Actions\u0027:dispatch/2"
            },
            {
              "name": "\u0027Elixir.MPP.Session.Actions\u0027:handle/2"
            }
          ],
          "repo": "https://github.com/ZenHive/mpp",
          "vendor": "ZenHive",
          "versions": [
            {
              "lessThan": "7270edc1dcfb58250cc5ee812876609206564165",
              "status": "affected",
              "version": "82df569c898be1137189e3648e1edb4af6363651",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ZenHive:mpp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.16.2",
                  "versionStartIncluding": "0.14.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "E.FU"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "E.FU"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "dateAssigned": "2026-09-15T15:23:05.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Validation of Specified Quantity in Input in ZenHive mpp allows a client holding an open payment channel to obtain paid resources without being charged.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eMPP.Session.Actions.accept_voucher/3\u003c/code\u003e in \u003ccode\u003elib/mpp/session/actions.ex\u003c/code\u003e treats a voucher whose \u003ccode\u003ecumulativeAmount\u003c/code\u003e equals the channel\u0027s already-accepted cumulative amount as an idempotent success, returning the channel unchanged without calling \u003ccode\u003emaybe_spend/2\u003c/code\u003e. The credential verifies, the protected resource is served, and \u003ccode\u003espent\u003c/code\u003e and \u003ccode\u003eunits\u003c/code\u003e stay where they were. Because the server issues a fresh challenge per request and the credential replay store keys on challenge id and payload, the same signed voucher can be re-presented under every new challenge, so one paid voucher yields an unbounded number of paid units. The path is reachable from any method built on \u003ccode\u003eMPP.Session.Method\u003c/code\u003e through the Plug, MCP, JSON-RPC and WebSocket transports.\u003c/p\u003e\n\u003cp\u003eThis issue affects mpp: from 0.14.0 before 0.16.2.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Improper Validation of Specified Quantity in Input in ZenHive mpp allows a client holding an open payment channel to obtain paid resources without being charged.\n\n`MPP.Session.Actions.accept_voucher/3` in `lib/mpp/session/actions.ex` treats a voucher whose `cumulativeAmount` equals the channel\u0027s already-accepted cumulative amount as an idempotent success, returning the channel unchanged without calling `maybe_spend/2`. The credential verifies, the protected resource is served, and `spent` and `units` stay where they were. Because the server issues a fresh challenge per request and the credential replay store keys on challenge id and payload, the same signed voucher can be re-presented under every new challenge, so one paid voucher yields an unbounded number of paid units. The path is reachable from any method built on `MPP.Session.Method` through the Plug, MCP, JSON-RPC and WebSocket transports.\n\nThis issue affects mpp: from 0.14.0 before 0.16.2."
            }
          ],
          "value": "Improper Validation of Specified Quantity in Input in ZenHive mpp allows a client holding an open payment channel to obtain paid resources without being charged.\n\nMPP.Session.Actions.accept_voucher/3 in lib/mpp/session/actions.ex treats a voucher whose cumulativeAmount equals the channel\u0027s already-accepted cumulative amount as an idempotent success, returning the channel unchanged without calling maybe_spend/2. The credential verifies, the protected resource is served, and spent and units stay where they were. Because the server issues a fresh challenge per request and the credential replay store keys on challenge id and payload, the same signed voucher can be re-presented under every new challenge, so one paid voucher yields an unbounded number of paid units. The path is reachable from any method built on MPP.Session.Method through the Plug, MCP, JSON-RPC and WebSocket transports.\n\nThis issue affects mpp: from 0.14.0 before 0.16.2."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-212",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eA client that has opened and funded a payment channel once can re-present the same signed voucher indefinitely and receive paid resources without any further charge. Operators running mpp as paid-API middleware lose revenue in proportion to how much the client consumes, with nothing in the channel state recording the usage.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "A client that has opened and funded a payment channel once can re-present the same signed voucher indefinitely and receive paid resources without any further charge. Operators running mpp as paid-API middleware lose revenue in proportion to how much the client consumes, with nothing in the channel state recording the usage."
                }
              ],
              "value": "A client that has opened and funded a payment channel once can re-present the same signed voucher indefinitely and receive paid resources without any further charge. Operators running mpp as paid-API middleware lose revenue in proportion to how much the client consumes, with nothing in the channel state recording the usage."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1284",
              "description": "CWE-1284 Improper Validation of Specified Quantity in Input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T11:16:29.573Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "name": "GitHub Advisory",
          "tags": [
            "related",
            "vendor-advisory"
          ],
          "url": "https://github.com/ZenHive/mpp/security/advisories/GHSA-8c63-r789-xrrf"
        },
        {
          "name": "EEF CNA record for CVE-2026-89420",
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-89420.html"
        },
        {
          "name": "OSV record EEF-CVE-2026-89420",
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-89420"
        },
        {
          "name": "Introducing commit 82df569 in ZenHive/mpp",
          "tags": [
            "related"
          ],
          "url": "https://github.com/ZenHive/mpp/commit/82df569c898be1137189e3648e1edb4af6363651"
        },
        {
          "name": "Fix commit 7270edc in ZenHive/mpp",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ZenHive/mpp/commit/7270edc1dcfb58250cc5ee812876609206564165"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Session voucher adding no new funds is accepted without a charge in mpp, serving paid resources for free"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-89420",
    "datePublished": "2026-09-22T11:16:29.573Z",
    "dateReserved": "2026-09-11T19:00:02.531Z",
    "dateUpdated": "2026-09-22T12:04:43.291Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-96M7-5WFV-978M

CVE-2026-89420 (GCVE-0-2026-89420)

Tags

Sightings

Nomenclature

Related by attack behaviour