CVE-2026-73829: mpp Tempo Non-Atomic Hash-Credential Deduplication Vulnerability
Summary
CVE-2026-73829: Time-of-check Time-of-use (TOCTOU) Race Condition in ZenHive mpp allows an unauthenticated remote client to redeem one confirmed on-chain payment for multiple paid-resource accesses. Affects mpp across 2 version ranges.
>= 0.2.0, < 0.6.1
>= f8904666061fbab695874856d8fcd02c471dfe1b, < 46c5b0e1311da7d92190dc7d9ea89027a1d365e9
Fixed in 0.6.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mpp package, developed by ZenHive, is a library designed for multi-party payments (MPP) in blockchain applications. It facilitates the secure handling of on-chain payments, ensuring that transactions are processed efficiently. However, the package has a vulnerability in its Tempo method, which can lead to unauthorized access to paid resources if not properly configured.
Vulnerability Detail
The vulnerability arises from a Time-of-Check Time-of-Use (TOCTOU) race condition in the mpp Tempo method. This flaw allows an unauthenticated remote client to redeem a confirmed on-chain payment multiple times due to a non-atomic check-then-mark sequence. Specifically, the method checks if a payment hash is unused, verifies the payment on-chain, and then marks it as used. If multiple requests are made concurrently with the same payment hash, they can all pass the initial check before any of them marks the hash as used, resulting in multiple receipts being issued for the same payment. This issue affects versions of mpp from 0.2.0 to before 0.6.1, and exploitation requires a deduplication store to be configured, as the default nil store does not provide any replay protection.
How To Fix
Latest published version: 0.20.1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.6.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update the package immediately, consider configuring a deduplication store that implements atomic operations. This can help mitigate the risk of replay attacks until you can apply the patch.
Conclusion
CVE-2026-73829 is a significant vulnerability in the mpp package that can lead to unauthorized access to paid resources. It is crucial for users of the package to update to version 0.6.1 or later to mitigate this risk. Additionally, configuring a proper deduplication store can provide an interim solution until the update is applied.
See every vulnerability recorded for mpp →
FAQ
CVE-2026-73829 is a vulnerability in the mpp package that allows unauthorized access to resources through a race condition in the payment verification process.
Versions of mpp from 0.2.0 to before 0.6.1 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package, configure a deduplication store that implements atomic operations to mitigate the risk of replay attacks.
The CVSS score of this vulnerability is 6.3, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for mpp.
