The vulnerability arises when a static memo is used in the Tempo method configuration of ZenHive mpp. Because the memo no longer contains a unique attribution nonce, the memo‑binding check unconditionally succeeds, and the transfer is validated solely on token, recipient, amount, and the static memo. The memo is echoed in unauthenticated 402 responses, making it discoverable to any actor. A third party can capture a transfer that was paid by a legitimate customer, request a new challenge for the same route, and replay the captured transaction hash as a type="hash" credential. This bypasses authentication entirely, allowing the attacker to obtain paid resources that were originally reserved for the original payer. The flaw is a classic authentication bypass that directly compromises integrity and confidentiality of paid services.

ZenHive mpp is the affected product. The issue impacts all releases beginning with version 0.6.1 and continuing through any release prior to 0.6.4. Current stable releases before 0.6.4 should be classified as vulnerable until the vendor publishes a fix; upgrading to 0.6.4 or later removes the flaw.

With a CVSS score of 8.2, the vulnerability is considered high severity. Although the EPSS score is not available and the flaw is not listed in the CISA KEV catalog, the attack path is straightforward: an unauthenticated network request to the public transfer endpoint coupled with knowledge of a static memo value. The exploitation does not require local privileges or sophisticated tooling, making it accessible to any actor who can observe public 402 responses. The risk remains significant even without confirmed exploitation; immediate patching or mitigation is advised, and monitoring of replay activity is recommended.