CVE-2026-87119
Description
Authentication Bypass by Capture-replay in ZenHive mpp allows an attacker holding a captured subscription activation credential to charge the payer repeatedly. The payer signs a Tempo KeyAuthorization over the chain id, key type, key id, expiry, limits and scopes only, with nothing tying it to the challenge that prompted it. MPP.Methods.Tempo.KeyAuthorization.verify/3 in lib/mpp/methods/tempo/key_authorization.ex pins each of those signed fields against the subscription request, and the access key it pins is a static per-endpoint server key, so one signed authorization verifies against every challenge the server issues for the same subscription terms. MPP.Methods.Tempo.Subscription.activate/4 deduplicates activations by challenge id, so presenting the captured credential under a fresh challenge produces a different dedup key, claim_activation succeeds, and the subscription transaction is built and broadcast again. Each replay charges the payer's wallet a new first-period settlement and re-authorizes the server key, bounded only by the subscription expiry and the chain's own semantics for re-installing an existing key. This issue affects mpp: from 0.14.0 before 0.16.2.
Is your site exposed to CVE-2026-87119?
Run a free security scan — no signup, results in seconds.
EPSS — Exploit Prediction
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
Weakness Type (CWE)
References
Other References
Frequently Asked Questions
What is CVE-2026-87119? +
How do I check if I'm vulnerable to CVE-2026-87119? +
Related Vulnerabilities
"Remember me" cookie age is not verified on the server. This potentially allows an attacker to intercept a valid cookie …
SMB forced authentication vulnerability in versions prior to 2025.35.000 of Sage 200 Spain. This vulnerability allows an authenticated attacker with …
A weakness identified in OpenText Advanced Authentication where a Malicious browser plugin can record and replay the user authentication process …
Use of fixed learning codes, one code to lock the car and the other code to unlock it, in the …
Use of fixed learning codes, one code to lock the car and the other code to unlock it, the Key …
Transmitted data is logged between the device and the backend service. An attacker could use these logs to perform a …
