GHSA-fxc9-7j2w-vx54
mpp has multiple payment bypass and griefing vulnerabilities
Impact
Multiple vulnerabilities were discovered which allowed for undesirable behaviors, including:
- Performing free
tempo/chargerequests - Replaying existing
tempo/chargerequests - Performing free
tempo/sessionrequests - Piggybacking off existing
tempo/sessionchannels - Griefing existing
tempo/sessionchannels - Manipulate the fee payer of a
tempo/chargeortempo/sessionhandler into paying for requests - Replaying existing
stripe/chargerequests
Patches
The issues are patched in 0.8.0
Workarounds
There are no workarounds available for these vulnerabilities
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
What each source reports
GitHub Advisories Score used
mpp has multiple payment bypass and griefing vulnerabilities
Impact
Multiple vulnerabilities were discovered which allowed for undesirable behaviors, including:
- Performing free
tempo/chargerequests - Replaying existing
tempo/chargerequests - Performing free
tempo/sessionrequests - Piggybacking off existing
tempo/sessionchannels - Griefing existing
tempo/sessionchannels - Manipulate the fee payer of a
tempo/chargeortempo/sessionhandler into paying for requests - Replaying existing
stripe/chargerequests
Patches
The issues are patched in 0.8.0
Workarounds
There are no workarounds available for these vulnerabilities
- Record
GHSA-fxc9-7j2w-vx54- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N - Weakness
- CWE-288, CWE-294, CWE-345
- Updated
- 2026-11-02
OSV
mpp has multiple payment bypass and griefing vulnerabilities
Impact
Multiple vulnerabilities were discovered which allowed for undesirable behaviors, including:
- Performing free
tempo/chargerequests - Replaying existing
tempo/chargerequests - Performing free
tempo/sessionrequests - Piggybacking off existing
tempo/sessionchannels - Griefing existing
tempo/sessionchannels - Manipulate the fee payer of a
tempo/chargeortempo/sessionhandler into paying for requests - Replaying existing
stripe/chargerequests
Patches
The issues are patched in 0.8.0
Workarounds
There are no workarounds available for these vulnerabilities
- Record
GHSA-fxc9-7j2w-vx54- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N - Weakness
- CWE-288, CWE-294, CWE-345
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mppcrates.io | before 0.8.0 | 0.8.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-fxc9-7j2w-vx54 is a critical vulnerability (CVSS 9.3) in mpp, published March 29, 2026. No source lists public exploit code. Fixed in mpp 0.8.0.