Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-73829— Non-atomic hash-credential dedup in mpp Tempo allows replay of a confirmed payment under a concurrent race

Quick assessment

Affected
ZenHive mpp
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ZenHive MPP是ZenHive组织开源的一款嵌入式服务器。 ZenHive MPP 0.2.0版本至0.6.1之前版本存在竞争条件问题漏洞，该漏洞源于type="hash"凭据路径中的检查与标记操作非原子，存在TOCTOU竞争条件，并发请求携带相同已结算支付哈希时均通过检查，可能导致未认证远程客户端使用一次已确认的链上支付多次访问付费资源。

CVSS 6.3 · Medium EPSS 0.24% · P15

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 2

VendorProduct Version RangeStatus
ZenHive mpp 0.2.0< 0.6.1 affected
f8904666061fbab695874856d8fcd02c471dfe1b< 46c5b0e1311da7d92190dc7d9ea89027a1d365e9 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-73829

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Non-atomic hash-credential dedup in mpp Tempo allows replay of a confirmed payment under a concurrent race
Source: CVE Program / CVE List V5
Vulnerability Description
Time-of-check Time-of-use (TOCTOU) Race Condition in ZenHive mpp allows an unauthenticated remote client to redeem one confirmed on-chain payment for multiple paid-resource accesses. The type="hash" credential path in MPP.Methods.Tempo.verify/2 guards against replay with a non-atomic check-then-mark sequence: check_hash_unused/2 reads the dedup store, an eth_getTransactionReceipt round trip verifies the payment on chain, and only then does mark_hash_used/2 write the mark. Concurrent requests carrying the same settled payment hash all pass the read before any of them writes, so each is issued a receipt. The store's atomic check_and_mark/2 primitive is available and used by the type="transaction" path, but the hash path calls plain get and put even when the configured store implements it. Exploitation requires a dedup store to be configured; the default nil store is stateless and documented as offering no replay protection at all. This issue affects mpp: from 0.2.0 before 0.6.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
检查时间与使用时间(TOCTOU)的竞争条件
Source: CVE Program / CVE List V5
Vulnerability Title
ZenHive MPP 竞争条件问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
ZenHive MPP是ZenHive组织开源的一款嵌入式服务器。 ZenHive MPP 0.2.0版本至0.6.1之前版本存在竞争条件问题漏洞，该漏洞源于type="hash"凭据路径中的检查与标记操作非原子，存在TOCTOU竞争条件，并发请求携带相同已结算支付哈希时均通过检查，可能导致未认证远程客户端使用一次已确认的链上支付多次访问付费资源。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
ZenHive mpp 0.2.0 ~ 0.6.1 cpe:2.3:a:ZenHive:mpp:*:*:*:*:*:*:*:*
ZenHive mpp f8904666061fbab695874856d8fcd02c471dfe1b ~ 46c5b0e1311da7d92190dc7d9ea89027a1d365e9 cpe:2.3:a:ZenHive:mpp:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-73829

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-73829

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-73829 (3)

Same Patch Batch · ZenHive · 2026-08-19 · 4 CVEs total

CVE-2026-67581 8.7 HIGH On-chain transfer proof is not single-use in mpp EVM payment method, enabling cross-challe
CVE-2026-73541 8.3 HIGH Tempo fee sponsorship in mpp bounds each transaction but not aggregate exposure, allowing
CVE-2026-73136 8.2 HIGH Static memo configuration in mpp Tempo disables per-challenge attribution binding, enablin

IV. Related Vulnerabilities

Same product: mpp
Same vendor: ZenHive
Same weakness: CWE-367

V. Comments for CVE-2026-73829

No comments yet

Leave a comment