{"id":"EEF-CVE-2026-89420","summary":"Session voucher adding no new funds is accepted without a charge in mpp, serving paid resources for free","details":"## Summary\n\nImproper Validation of Specified Quantity in Input in ZenHive mpp allows a client holding an open payment channel to obtain paid resources without being charged.\n\n`MPP.Session.Actions.accept_voucher/3` in `lib/mpp/session/actions.ex` treats a voucher whose `cumulativeAmount` equals the channel's already-accepted cumulative amount as an idempotent success, returning the channel unchanged without calling `maybe_spend/2`. The credential verifies, the protected resource is served, and `spent` and `units` stay where they were. Because the server issues a fresh challenge per request and the credential replay store keys on challenge id and payload, the same signed voucher can be re-presented under every new challenge, so one paid voucher yields an unbounded number of paid units. The path is reachable from any method built on `MPP.Session.Method` through the Plug, MCP, JSON-RPC and WebSocket transports.\n\nThis issue affects mpp: from 0.14.0 before 0.16.2.\n\n## Impact\n\nA client that has opened and funded a payment channel once can re-present the same signed voucher indefinitely and receive paid resources without any further charge. Operators running mpp as paid-API middleware lose revenue in proportion to how much the client consumes, with nothing in the channel state recording the usage.","aliases":["CVE-2026-89420","GHSA-8c63-r789-xrrf"],"modified":"2026-09-22T11:40:55.031451599Z","published":"2026-09-22T11:16:29.573Z","database_specific":{"capec_ids":["CAPEC-212"],"cpe_ids":["cpe:2.3:a:ZenHive:mpp:*:*:*:*:*:*:*:*"],"cwe_ids":["CWE-1284"]},"references":[{"type":"ADVISORY","url":"https://github.com/ZenHive/mpp/security/advisories/GHSA-8c63-r789-xrrf"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-89420.html"},{"type":"WEB","url":"https://github.com/ZenHive/mpp/commit/82df569c898be1137189e3648e1edb4af6363651"},{"type":"FIX","url":"https://github.com/ZenHive/mpp/commit/7270edc1dcfb58250cc5ee812876609206564165"},{"type":"PACKAGE","url":"https://hex.pm/packages/mpp"}],"affected":[{"package":{"name":"mpp","ecosystem":"Hex","purl":"pkg:hex/mpp"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.14.0"},{"fixed":"0.16.2"}]}],"versions":["0.14.0","0.15.0","0.16.0","0.16.1"],"database_specific":{"source":"https://cna.erlef.org/osv/EEF-CVE-2026-89420.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/ZenHive/mpp","events":[{"introduced":"82df569c898be1137189e3648e1edb4af6363651"},{"fixed":"7270edc1dcfb58250cc5ee812876609206564165"}]}],"versions":["v0.16.1","v0.16.0","v0.15.0","v0.14.0"],"database_specific":{"source":"https://cna.erlef.org/osv/EEF-CVE-2026-89420.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}],"credits":[{"name":"E.FU","type":"FINDER"},{"name":"E.FU","type":"REMEDIATION_DEVELOPER"},{"name":"Jonatan Männchen / EEF","type":"COORDINATOR"}]}