Description
Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored payment by a large multiplier and to have the sponsor pay for provisioning an access key on the client's own account.

When the server sponsors Tempo payments, MPP.Methods.Tempo.FeePayerPolicy.measure/3 in lib/mpp/methods/tempo/fee_payer_policy.ex bounds the gas fields, the fee budget, the validity window and the access list of the client-signed 0x76 envelope, but does not check whether the envelope carries the optional key_authorization field. A client can attach a fully signed key authorization, provisioning a new access key with token spending limits on its own account, alongside the normal payment call. The key and each limit entry are persistent storage writes billed as intrinsic gas to the sponsor, bounded only by the gas_limit ceiling. At the reporter's default of one key with three token limits the sponsored cost rises from about 46,587 gas to about 1,808,700 gas, and the client keeps a valid access key it paid nothing for.

This issue affects mpp: from 0.2.0 before 0.16.1.
Published: 2026-09-06
Score: 8.3 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Improper Validation of Specified Quantity in Input allows an unauthenticated remote client to attach a key_authorization field to a Tempo payment request, causing the sponsor to pay for an access key that the client did not authorize and inflating the transaction gas cost by a large multiplier. The attacker gains a persistent key they paid nothing for, while the sponsor incurs potentially massive gas fees.

Affected Systems

ZenHive mpp, all releases from 0.2.0 up to but not including version 0.16.1, is affected.

Risk and Exploitability

The CVSS score indicates high severity (8.3). No EPSS score is available and the vulnerability is not listed in KEV, but the attack vector is likely remote unauthenticated, requiring a client to send a specially crafted Tempo request over the network. An attacker can immediately force the sponsor to pay inflated gas costs and provision an unauthorized access key without further privileges.

Generated by OpenCVE AI on September 6, 2026 at 17:20 UTC.

Remediation

Vendor Workaround

Disable Tempo fee sponsorship by leaving "fee_payer" at its default of false and setting no fee_payer_url, so the client pays its own gas. Where sponsorship must stay enabled, lower the max_gas override in fee_payer_policy to just above what a legitimate sponsored payment needs (a TIP-20 transfer is roughly 50,000 gas), so an envelope carrying a key authorization either fails the policy or runs out of gas at a bounded cost. This bounds the inflation without closing it.

OpenCVE Recommended Actions

  • Upgrade ZenHive mpp to v0.16.1 or later.
  • Disable Tempo fee sponsorship or set fee_payer_policy.max_gas to a low value that bounds gas usage.
  • Monitor the sponsor account for unexpected key provisioning and anomalously high gas consumption.

Generated by OpenCVE AI on September 6, 2026 at 17:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 06 Sep 2026 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Zenhive
Zenhive mpp
Vendors & Products Zenhive
Zenhive mpp

Sun, 06 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Description Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored payment by a large multiplier and to have the sponsor pay for provisioning an access key on the client's own account. When the server sponsors Tempo payments, MPP.Methods.Tempo.FeePayerPolicy.measure/3 in lib/mpp/methods/tempo/fee_payer_policy.ex bounds the gas fields, the fee budget, the validity window and the access list of the client-signed 0x76 envelope, but does not check whether the envelope carries the optional key_authorization field. A client can attach a fully signed key authorization, provisioning a new access key with token spending limits on its own account, alongside the normal payment call. The key and each limit entry are persistent storage writes billed as intrinsic gas to the sponsor, bounded only by the gas_limit ceiling. At the reporter's default of one key with three token limits the sponsored cost rises from about 46,587 gas to about 1,808,700 gas, and the client keeps a valid access key it paid nothing for. This issue affects mpp: from 0.2.0 before 0.16.1.
Title Unbounded key authorization in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors access-key provisioning
First Time appeared Zenhive
Zenhive mpp
Weaknesses CWE-1284
CPEs cpe:2.3:a:ZenHive:mpp:*:*:*:*:*:*:*:*
Vendors & Products Zenhive
Zenhive mpp
References
Metrics cvssV4_0

{'score': 8.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Zenhive Mpp
Zenhive Mpp
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-09-06T16:07:26.407Z

Reserved: 2026-08-31T01:00:09.775Z

Link: CVE-2026-82751

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-06T17:17:56.070

Modified: 2026-09-06T17:17:56.070

Link: CVE-2026-82751

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-06T18:30:06Z

Weaknesses
  • CWE-1284

    Improper Validation of Specified Quantity in Input