目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CVE-2026-87119— mpp Tempo subscription key authorization is not bound to the issuing challenge, allowing a captured activation credential to be replayed

一分钟漏洞结论

影响对象
ZenHive mpp
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。

Authentication Bypass by Capture-replay in ZenHive mpp allows an attacker holding a captured subscription activation credential to charge the payer repeatedly. The payer signs a Tempo KeyAuthorization over the chain id, key type, key id, expiry, limits and sco

CVSS 8.2 · High

影响版本矩阵 2

厂商产品 版本范围状态
ZenHive mpp 0.14.0< 0.16.2 affected
db464dfa9a86ccda58f0827101f6da6bd8aafa78< 4b6eaec02af0e8485cfb4ff68f467d075ed5dd6f affected
获取后续新漏洞提醒 登录后订阅

一、 漏洞 CVE-2026-87119 基础信息

漏洞信息

Shenlong is analyzing...

对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗

尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。

Vulnerability Title
mpp Tempo subscription key authorization is not bound to the issuing challenge, allowing a captured activation credential to be replayed
来源: CVE Program / CVE List V5
Vulnerability Description
Authentication Bypass by Capture-replay in ZenHive mpp allows an attacker holding a captured subscription activation credential to charge the payer repeatedly. The payer signs a Tempo KeyAuthorization over the chain id, key type, key id, expiry, limits and scopes only, with nothing tying it to the challenge that prompted it. MPP.Methods.Tempo.KeyAuthorization.verify/3 in lib/mpp/methods/tempo/key_authorization.ex pins each of those signed fields against the subscription request, and the access key it pins is a static per-endpoint server key, so one signed authorization verifies against every challenge the server issues for the same subscription terms. MPP.Methods.Tempo.Subscription.activate/4 deduplicates activations by challenge id, so presenting the captured credential under a fresh challenge produces a different dedup key, claim_activation succeeds, and the subscription transaction is built and broadcast again. Each replay charges the payer's wallet a new first-period settlement and re-authorizes the server key, bounded only by the subscription expiry and the chain's own semantics for re-installing an existing key. This issue affects mpp: from 0.14.0 before 0.16.2.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
来源: CVE Program / CVE List V5
Vulnerability Type
使用捕获-重放进行的认证绕过
来源: CVE Program / CVE List V5

受影响产品

厂商 产品 影响版本 CPE 订阅
ZenHive mpp 0.14.0 ~ 0.16.2 cpe:2.3:a:ZenHive:mpp:*:*:*:*:*:*:*:*
ZenHive mpp db464dfa9a86ccda58f0827101f6da6bd8aafa78 ~ 4b6eaec02af0e8485cfb4ff68f467d075ed5dd6f cpe:2.3:a:ZenHive:mpp:*:*:*:*:*:*:*:*

二、漏洞 CVE-2026-87119 的公开POC

# POC 描述 源链接 神龙链接
AI 生成 POC 高级

未找到公开 POC。

登录以生成 AI POC

三、漏洞 CVE-2026-87119 的情报信息

请登录查看更多情报信息。

CVE-2026-87119 其他参考 (3)

IV. Related Vulnerabilities

Same product: mpp
Same vendor: ZenHive
Same weakness: CWE-294

V. Comments for CVE-2026-87119

暂无评论

发表评论