{"affected":[{"package":{"ecosystem":"Hex","name":"mpp","purl":"pkg:hex/mpp"},"ranges":[{"events":[{"introduced":"0.14.0"},{"fixed":"0.16.2"}],"type":"SEMVER"}],"versions":["0.14.0","0.15.0","0.16.0","0.16.1"]},{"ranges":[{"events":[{"introduced":"82df569c898be1137189e3648e1edb4af6363651"},{"fixed":"7270edc1dcfb58250cc5ee812876609206564165"}],"repo":"https://github.com/ZenHive/mpp","type":"GIT"}]}],"aliases":["GHSA-8c63-r789-xrrf","CVE-2026-89420"],"credits":[{"name":"E.FU","type":"FINDER"},{"name":"E.FU","type":"REMEDIATION_DEVELOPER"},{"name":"Jonatan Männchen / EEF","type":"COORDINATOR"}],"database_specific":{"capec_ids":["CAPEC-212"],"cpe_ids":["cpe:2.3:a:ZenHive:mpp:*:*:*:*:*:*:*:*"],"cwe_ids":["CWE-1284"]},"details":"## Summary\n\nImproper Validation of Specified Quantity in Input in ZenHive mpp allows a client holding an open payment channel to obtain paid resources without being charged.\n\n`MPP.Session.Actions.accept_voucher/3` in `lib/mpp/session/actions.ex` treats a voucher whose `cumulativeAmount` equals the channel's already-accepted cumulative amount as an idempotent success, returning the channel unchanged without calling `maybe_spend/2`. The credential verifies, the protected resource is served, and `spent` and `units` stay where they were. Because the server issues a fresh challenge per request and the credential replay store keys on challenge id and payload, the same signed voucher can be re-presented under every new challenge, so one paid voucher yields an unbounded number of paid units. The path is reachable from any method built on `MPP.Session.Method` through the Plug, MCP, JSON-RPC and WebSocket transports.\n\nThis issue affects mpp: from 0.14.0 before 0.16.2.\n\n## Impact\n\nA client that has opened and funded a payment channel once can re-present the same signed voucher indefinitely and receive paid resources without any further charge. Operators running mpp as paid-API middleware lose revenue in proportion to how much the client consumes, with nothing in the channel state recording the usage.","id":"EEF-CVE-2026-89420","modified":"2026-09-22T11:16:30.078564Z","published":"2026-09-22T11:16:29.573Z","references":[{"type":"ADVISORY","url":"https://github.com/ZenHive/mpp/security/advisories/GHSA-8c63-r789-xrrf"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-89420.html"},{"type":"WEB","url":"https://github.com/ZenHive/mpp/commit/82df569c898be1137189e3648e1edb4af6363651"},{"type":"FIX","url":"https://github.com/ZenHive/mpp/commit/7270edc1dcfb58250cc5ee812876609206564165"},{"type":"PACKAGE","url":"https://hex.pm/packages/mpp"}],"related":[],"schema_version":"1.7.3","severity":[{"score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","type":"CVSS_V4"}],"summary":"Session voucher adding no new funds is accepted without a charge in mpp, serving paid resources for free","upstream":[]}