The vulnerability exists in ZenHive mpp's voucher processing when a voucher’s cumulative amount equals the channel’s already-accepted cumulative amount. The server treats such vouchers as idempotent successes, serves the protected resource, but does not deduct the quantity. Because each request presents a new challenge, the same signed voucher can be replayed indefinitely, allowing an attacker with an open payment channel to access paid resources without any additional charge. Resulting in unauthorized use of paid resources and financial loss for service providers.

Affected systems are ZenHive mpp version 0.14.0 up to but excluding 0.16.2. The vulnerability impacts all deployments that rely on the open payment channel mechanism provided by mpp. In particular, any server running the MPP.Session.Actions module that accepts vouchers from clients is susceptible.

With a CVSS score of 7.1, the vulnerability presents a high impact level. No EPSS data is available, and the issue is not listed in the CISA KEV catalog, suggesting that exploitation is not confirmed in the wild. Nonetheless, the attack vector is network based, reachable via Plug, MCP, JSON‑RPC, or WebSocket transports. An attacker who can create or obtain a valid signed voucher and maintains an open payment channel could repeatedly replay the voucher for each new challenge, receiving uncharged paid units. Control of the client side is therefore required, but the network path makes remote exploitation feasible.