The bug arises from an unsafe equivalence validation in ZenHive mpp's Tempo component. The reserve key used to block duplicate submissions is derived from the caller‑supplied hexadecimal representation of the transaction, rather than a canonical hash. Because the deserializer accepts both recovery‑id encodings, the same signed transaction can be encoded with either v=27 or v=0, producing two distinct reserve keys that both pass the reserve check and reach the broadcast path. The result is that an attacker can submit the same transaction twice; on nodes that return the canonical hash for a known transaction, the second submission can succeed and produce a second Payment‑Receipt, effectively creating a double‑spend or an unauthorized payment acknowledgment. On nodes that reject duplicate nonces, the request fails, but the possibility of inconsistent behaviour increases system risk.

ZenHive mpp, versions 0.2.0 through 0.16.1 inclusive, are impacted. Any deployment that exposes the Tempo endpoint and uses these versions is susceptible.

The CVSS score of 6.3 classifies the issue as moderate to high severity, and the absence of an EPSS score does not reduce the practical risk. Because the attack requires only an unauthenticated remote client that can craft two differently encoded signatures for the same transaction, it is relatively easy to launch. Although the vulnerability is not yet listed in CISA’s KEV catalogue, the potential for double‑spend attacks means administrators should treat it as a priority. The primary attack vector is a remote network request to the Tempo service.