{"id":"EEF-CVE-2026-67581","summary":"On-chain transfer proof is not single-use in mpp EVM payment method, enabling cross-challenge replay","details":"## Summary\n\nAuthentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated remote client to obtain paid resources by resubmitting one settled on-chain transfer.\n\n`MPP.Methods.EVM.verify/2` accepts a transaction-hash credential and matches a transfer purely on `token`, `to` and `amount` (ERC-20) or `to` and `value` (native). It binds the proof neither to the challenge being verified nor to any record of prior use, and the generic `MPP.Plug` dedup store keys on `challenge.id`, which is regenerated for every 402 response. On a static-price route, a single historical transfer matching the charge therefore satisfies an unbounded number of later charges, including transfers an attacker can read off a public block explorer.\n\nThis issue affects mpp: from 0.3.0 before 0.6.3.\n\n## Workarounds\n\nPrice each challenge uniquely (per-challenge or single-use amounts) so that a historical transfer cannot match a later charge, and keep challenge expiry short to narrow the window in which any given transfer stays useful. Deployments that can use the Tempo method for on-chain payments get per-challenge attribution binding instead.","aliases":["CVE-2026-67581","GHSA-vp5h-xh25-44wf"],"modified":"2026-09-08T05:45:02.680325517Z","published":"2026-08-19T17:20:09.606Z","database_specific":{"capec_ids":["CAPEC-60"],"cpe_ids":["cpe:2.3:a:ZenHive:mpp:*:*:*:*:*:*:*:*"],"cwe_ids":["CWE-294"]},"references":[{"type":"ADVISORY","url":"https://github.com/ZenHive/mpp/security/advisories/GHSA-vp5h-xh25-44wf"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-67581.html"},{"type":"FIX","url":"https://github.com/ZenHive/mpp/commit/ecc038088b1cda09ad8a84acc6cc112addb4a68f"},{"type":"PACKAGE","url":"https://hex.pm/packages/mpp"}],"affected":[{"package":{"name":"mpp","ecosystem":"Hex","purl":"pkg:hex/mpp"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.3.0"},{"fixed":"0.6.3"}]}],"versions":["0.3.0","0.3.1","0.3.2","0.4.0","0.6.0","0.6.1","0.6.2"],"database_specific":{"source":"https://cna.erlef.org/osv/EEF-CVE-2026-67581.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/ZenHive/mpp","events":[{"introduced":"65b9e425ce27631c786a5b380b5e4c5ae607ec6d"},{"fixed":"ecc038088b1cda09ad8a84acc6cc112addb4a68f"}]}],"versions":["v0.6.1","v0.6.0","v0.5.1","v0.4.0","v0.3.0"],"database_specific":{"source":"https://cna.erlef.org/osv/EEF-CVE-2026-67581.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}],"credits":[{"name":"E.FU","type":"FINDER"},{"name":"E.FU","type":"REMEDIATION_DEVELOPER"},{"name":"Jonatan Männchen / EEF","type":"ANALYST"}]}