mppx, a TypeScript interface for machine payments, fails to check Stripe’s Idempotent-Replayed header when creating PaymentIntents. As a result an attacker who holds a valid credential containing an spt token can resend the same credential in a new request. The server accepts the replayed Stripe PaymentIntent as a fresh transaction, charging the customer only once while allowing the attacker to consume unlimited resources. The likely attack vector is an API request that reuses the same credential with a new challenge; this is inferred from the description of replaying a credential against a new challenge.

The vulnerability exists in versions of wevm’s mppx prior to 0.4.11. Any deployment that incorporates the stripe/charge payment method and has not upgraded to version 0.4.11 is susceptible. The patch was released in the 0.4.11 release and removes the missing idempotency check.

The common vulnerability scoring system assigns a CVSS score of 6, indicating moderate severity. The EPSS score is below 1 %, suggesting a low likelihood of exploitation in the wild, and the issue is not listed in the CISA KEV catalog. An attacker can exploit the flaw by sending a replayed API request with a valid spt token; no special hardware or privileged access is required beyond possession of the credential. While the risk of exploitation is considered moderate, the impact of successful attacks could be substantial for affected payment services.