ZenHive vulnerabilities
We track 10 vulnerabilities in ZenHive products across 2 products. 10 are rated high or critical, and none are known to be exploited. The most recent was published on September 22, 2026.
Latest ZenHive vulnerabilities
- 7.1 High severity
mpp: Improper Validation of Specified Quantity in Input
Improper Validation of Specified Quantity in Input in ZenHive mpp allows a client holding an open payment channel to obtain paid resources without being charged. MPP.Session.Actions.accept_voucher/3 in lib/mpp/session/actions.ex treats a voucher whose cumulati
- 8.2 High severity
mpp: Authentication Bypass by Capture-replay
Authentication Bypass by Capture-replay in ZenHive mpp allows an attacker holding a captured subscription activation credential to charge the payer repeatedly. The payer signs a Tempo KeyAuthorization over the chain id, key type, key id, expiry, limits and sco
- 8.3 High severity
mpp: Improper Validation of Specified Quantity in Input
Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored payment by a large multiplier and to have the sponsor pay for provisioning an access key on the client's
- 8.3 High severity
mpp: Improper Validation of Specified Quantity in Input
Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored payment by a large multiplier and to have the sponsor pay for EIP-7702 account delegations of the client
- 8.2 High severity
mpp: Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet through concurrent sponsored payments, denying service to legitimate payers once it is empty. MPP.Methods.Tempo.FeePayerPo
- 7.5 High severity
mpp: Authentication Bypass by Capture-replay
Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated third party to obtain paid resources by replaying a transfer settled by an unrelated payer. MPP.Methods.Tempo normally binds a settled TIP-20 TransferWithMemo to the specific chal
- 7.5 High severity
mpp: Authentication Bypass by Capture-replay
Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated remote client to obtain paid resources by resubmitting one settled on-chain transfer. MPP.Methods.EVM.verify/2 accepts a transaction-hash credential and matches a transfer purely
- 8.3 High severity
mpp: Improper Validation of Specified Quantity in Input
Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet in a single request by naming an arbitrarily high gas price. When the mpp Elixir library is configured as fee payer (fee_pay
- 8.3 High severity
mpp: Improper Validation of Specified Quantity in Input
Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per payment by a large multiplier, degrading the sponsor's operating margin. When the mpp Elixir library is configured
- 8.2 High severity
mpp: Improper Validation of Specified Quantity in Input
Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet, resulting in denial of service for legitimate clients. When the mpp Elixir library is configured as fee payer (fee_payer: t