CVE-2026-73829 Non-atomic hash-credential dedup in mpp Tempo allows replay of a confirmed payment under a concurrent race
Attackers can replay confirmed payments for multiple accesses due to a race condition in the hash credential verification path.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-73829?
CVE-2026-73829 is a medium-severity vulnerability in ZenHive mpp, published on 19 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Time-of-check Time-of-use (TOCTOU) Race Condition in ZenHive mpp allows an unauthenticated remote client to redeem one confirmed on-chain payment for multiple paid-resource accesses.
The type="hash" credential path in MPP.Methods.Tempo.verify/2 guards against replay with a non-atomic check-then-mark sequence: check_hash_unused/2 reads the dedup store, an eth_getTransactionReceipt round trip verifies the payment on chain, and only then does mark_hash_used/2 write the mark. Concurrent requests carrying the same settled payment hash all pass the read before any of them writes, so each is issued a receipt. The store's atomic check_and_mark/2 primitive is available and used by the type="transaction" path, but the hash path calls plain get and put even when the configured store implements it. Exploitation requires a dedup store to be configured; the default nil store is stateless and documented as offering no replay protection at all.
This issue affects mpp: from 0.2.0 before 0.6.1.
Weakness: CWE-367
Which versions are affected by CVE-2026-73829?
1 open source package ship an affected version, including mpp. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mpp Hex | From 0.2.0 | 0.6.1 |
Products include Zenhive Machine Payments Protocol.
How do I fix CVE-2026-73829?
Upgrade mpp to 0.6.1 or later.
Is CVE-2026-73829 being exploited?
There is no known exploitation of CVE-2026-73829 in the wild and no public exploit code.
Other vulnerabilities in ZenHive mpp
Sources
Also known as EEF-CVE-2026-73829, GHSA-vjfr-ffhr-5g8p, GHSA-w8j7-7qc3-5f24.