ZenHive mpp

• CVE-2026-87119 High 8.2 mpp Tempo subscription key authorization is not bound to the issuing challenge, allowing a captured activation credential to be replayed 0.6%
• CVE-2026-89420 High 7.1 Session voucher adding no new funds is accepted without a charge in mpp, serving paid resources for free 0.4%
• CVE-2026-88255 Medium 6.3 mpp Tempo keys its pre-broadcast dedup reserve on the caller-supplied transaction encoding, so a re-encoded signed transaction reserves a second slot 0.5%
• CVE-2026-89186 Medium 6.3 mpp writes Payment-Receipt and Cache-Control before the wrapped application runs, letting a consumer's own Cache-Control expose paid responses to shared caches 0.5%
• CVE-2026-82750 High 8.3 Unbounded EIP-7702 authorization list in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors account delegation 0.5%
• CVE-2026-82751 High 8.3 Unbounded key authorization in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors access-key provisioning 0.5%
• CVE-2026-67581 High 8.7 On-chain transfer proof is not single-use in mpp EVM payment method, enabling cross-challenge replay 0.6%
• CVE-2026-73541 High 8.3 Tempo fee sponsorship in mpp bounds each transaction but not aggregate exposure, allowing concurrent sponsor-wallet drain 0.6%
• CVE-2026-73136 High 8.2 Static memo configuration in mpp Tempo disables per-challenge attribution binding, enabling third-party replay 0.6%
• CVE-2026-73829 Medium 6.3 Non-atomic hash-credential dedup in mpp Tempo allows replay of a confirmed payment under a concurrent race 0.3%
• CVE-2026-59252 High 8.2 Missing gas_limit validation in mpp Tempo fee-payer enables wallet drain 0.5%
• CVE-2026-59694 High 8.3 Unbounded access list in mpp Tempo fee-payer inflates gas cost per payment 0.5%
• CVE-2026-59695 High 8.3 Unbounded max_fee_per_gas in mpp Tempo fee-payer enables single-request wallet drain 0.5%