CVE-2026-73136: mpp Tempo Static Memo Configuration Vulnerability Leading to Authentication Bypass
Summary
CVE-2026-73136: Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated third party to obtain paid resources by replaying a transfer settled by an unrelated payer. Affects mpp across 2 version ranges.
>= 0.6.1, < 0.6.4
>= 542a525563c2fcedd670b593437deca81c6797a4, < 2207d7f456ae14c1d3fcacc6f635bf4f8cee1a34
Fixed in 0.6.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The mpp package, developed by ZenHive, is a library designed for handling TIP-20 token transfers within decentralized applications. It provides various methods for managing transactions, including the Tempo method, which is responsible for binding transfers to specific challenges for verification. However, a misconfiguration involving static memo values can lead to significant security vulnerabilities, allowing unauthorized access to paid resources.
Vulnerability Detail
The vulnerability arises from the static configuration of the memo in the Tempo method, which disables per-challenge attribution binding. This allows an unauthenticated third party to replay a transfer settled by an unrelated payer. When a static memo is set, the system unconditionally matches the memo, bypassing necessary checks that tie the transfer to the challenge being verified. As a result, attackers can exploit this flaw to obtain resources by presenting a valid transaction hash without proper authentication.
How To Fix
Minimum fixed version
0.6.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, remove the static memo from the Tempo method configuration. This will revert the verification process to the default per-challenge attribution binding. If a static memo is necessary, configure a deduplication store (e.g., MPP.Tempo.ConCacheStore) with a TTL that matches or exceeds the challenge expiry to mitigate replay attacks.
Conclusion
CVE-2026-73136 is a critical vulnerability in the mpp package that can lead to unauthorized access through improper memo configuration. It is essential to update to the patched version or implement the recommended workarounds to secure your application against potential exploitation.
See every vulnerability recorded for mpp →
FAQ
CVE-2026-73136 is a vulnerability in the mpp package that allows unauthorized access to resources through an authentication bypass due to static memo configuration.
If your application uses the mpp package with a static memo configuration, it may be susceptible to replay attacks, allowing unauthorized users to access paid resources.
As a temporary measure, remove the static memo from the Tempo method configuration or implement a deduplication store to mitigate the risk of replay attacks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2026-73136 is 8.2, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for mpp.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
