{"id":"GHSA-fxc9-7j2w-vx54","aliases":[],"status":"published","title":"mpp has multiple payment bypass and griefing vulnerabilities","description":"### Impact\nMultiple vulnerabilities were discovered which allowed for undesirable behaviors, including:\n- Performing free `tempo/charge` requests\n- Replaying existing `tempo/charge` requests\n- Performing free `tempo/session` requests\n- Piggybacking off existing `tempo/session` channels\n- Griefing existing `tempo/session` channels\n- Manipulate the fee payer of a `tempo/charge` or `tempo/session` handler into paying for requests\n- Replaying existing `stripe/charge` requests\n\n### Patches\nThe issues are patched in 0.8.0\n\n### Workarounds\nThere are no workarounds available for these vulnerabilities","severity":{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N","level":"critical","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-288","CWE-294","CWE-345"],"published":"2026-03-29T15:20:45Z","modified":"2026-04-01T09:10:43Z","fixes":[{"ecosystem":"crates.io","package":"mpp","fixed_in":["0.8.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"mpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"mpp","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.8.0"}]}]}],"references":[{"url":"https://github.com/tempoxyz/mpp-rs/security/advisories/GHSA-fxc9-7j2w-vx54","tags":["web"]},{"url":"https://github.com/tempoxyz/mpp-rs/releases/tag/v0.8.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-fxc9-7j2w-vx54"},{"url":"https://github.com/tempoxyz/mpp-rs","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-fxc9-7j2w-vx54","title":"mpp has multiple payment bypass and griefing vulnerabilities","description":"### Impact\nMultiple vulnerabilities were discovered which allowed for undesirable behaviors, including:\n- Performing free `tempo/charge` requests\n- Replaying existing `tempo/charge` requests\n- Performing free `tempo/session` requests\n- Piggybacking off existing `tempo/session` channels\n- Griefing existing `tempo/session` channels\n- Manipulate the fee payer of a `tempo/charge` or `tempo/session` handler into paying for requests\n- Replaying existing `stripe/charge` requests\n\n### Patches\nThe issues are patched in 0.8.0\n\n### Workarounds\nThere are no workarounds available for these vulnerabilities","status":"published","published":"2026-03-29T15:20:45Z","modified":"2026-04-01T09:10:43Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N","level":"critical"}],"cwes":["CWE-288","CWE-294","CWE-345"],"updated_at":"2026-11-02T14:39:47.075804Z"}],"osv":[{"id":"GHSA-fxc9-7j2w-vx54","title":"mpp has multiple payment bypass and griefing vulnerabilities","description":"### Impact\nMultiple vulnerabilities were discovered which allowed for undesirable behaviors, including:\n- Performing free `tempo/charge` requests\n- Replaying existing `tempo/charge` requests\n- Performing free `tempo/session` requests\n- Piggybacking off existing `tempo/session` channels\n- Griefing existing `tempo/session` channels\n- Manipulate the fee payer of a `tempo/charge` or `tempo/session` handler into paying for requests\n- Replaying existing `stripe/charge` requests\n\n### Patches\nThe issues are patched in 0.8.0\n\n### Workarounds\nThere are no workarounds available for these vulnerabilities","status":"published","published":"2026-03-29T15:20:45Z","modified":"2026-03-29T15:33:28.903431Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N","level":"critical"}],"cwes":["CWE-288","CWE-294","CWE-345"],"updated_at":"2026-11-02T15:46:47.119724Z"}]}}