A time‑of‑check time‑of‑use race in ZenHive mpp allows an unauthenticated remote client to redeem a confirmed on‑chain payment more than once. The hash‑credential path performs a non‑atomic check‑then‑mark sequence, permitting several concurrent requests to read the same unused hash before any of them can mark it as used, resulting in repeated receipts. This flaw is a classic example of CWE‑367, where the lack of atomicity leads to unauthorized reuse of a protected action.

The vulnerability affects ZenHive mpp versions from 0.2.0 up to, but not including, 0.6.1. Users running these versions should verify the deduplication store configuration, as the default nil store provides no replay protection.

The CVSS score of 6.3 indicates a moderate severity. EPSS is not available, and the flaw is not listed in the CISA KEV catalog, but the exploitation path is straightforward for any remote client that can send concurrent requests to the Tempo endpoint. Successful exploitation requires a functional deduplication store; the default stateless configuration offers no protection, making the risk higher for installations that use it.