Zenhive vulnerabilities

Products

• Mpp 13
• Machine Payments Protocol 4

Newest

• zenhive mpp mpp Tempo subscription key authorization is not bound to the issuing challenge, allowing a captured activation credential to be replayed CVE-2026-87119 Fix available 8.2 HighSeptember 22, 2026
• zenhive mpp Session voucher adding no new funds is accepted without a charge in mpp, serving paid resources for free CVE-2026-89420 Fix available 7.1 HighSeptember 22, 2026
• zenhive mpp mpp Tempo keys its pre-broadcast dedup reserve on the caller-supplied transaction encoding, so a re-encoded signed transaction reserves a second slot CVE-2026-88255 Fix available 6.3 MediumSeptember 16, 2026
• zenhive mpp mpp writes Payment-Receipt and Cache-Control before the wrapped application runs, letting a consumer's own Cache-Control expose paid responses to shared caches CVE-2026-89186 Fix available 6.3 MediumSeptember 16, 2026
• zenhive mpp Unbounded EIP-7702 authorization list in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors account delegation CVE-2026-82750 Fix available 8.3 HighSeptember 6, 2026
• zenhive mpp Unbounded key authorization in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors access-key provisioning CVE-2026-82751 Fix available 8.3 HighSeptember 6, 2026
• zenhive mpp, machine payments protocol +1 more On-chain transfer proof is not single-use in mpp EVM payment method, enabling cross-challenge replay CVE-2026-67581 Fix available 8.7 HighAugust 19, 2026
• zenhive mpp, machine payments protocol +1 more Tempo fee sponsorship in mpp bounds each transaction but not aggregate exposure, allowing concurrent sponsor-wallet drain CVE-2026-73541 Fix available 8.3 HighAugust 19, 2026
• zenhive mpp, machine payments protocol +1 more Static memo configuration in mpp Tempo disables per-challenge attribution binding, enabling third-party replay CVE-2026-73136 Fix available 8.2 HighAugust 19, 2026
• zenhive mpp, machine payments protocol +1 more Non-atomic hash-credential dedup in mpp Tempo allows replay of a confirmed payment under a concurrent race CVE-2026-73829 Fix available 6.3 MediumAugust 19, 2026
• zenhive mpp Missing gas_limit validation in mpp Tempo fee-payer enables wallet drain CVE-2026-59252 Fix available 8.2 HighJuly 17, 2026
• zenhive mpp Unbounded access list in mpp Tempo fee-payer inflates gas cost per payment CVE-2026-59694 Fix available 8.3 HighJuly 17, 2026
• zenhive mpp Unbounded max_fee_per_gas in mpp Tempo fee-payer enables single-request wallet drain CVE-2026-59695 Fix available 8.3 HighJuly 17, 2026