Improper input validation in ZenHive mpp (CVE-2026-59694)

CVE-2026-59694 is an improper input validation vulnerability in ZenHive mpp (Elixir) affecting the fee-payer co-signing flow. When configured as fee payer, `MPP.Tempo.Transaction.cosign_fee_payer/3` re-signs the client-supplied EIP-2930 access list verbatim as part of the 0x76 AASigned envelope without validating its length or contents, allowing an unauthenticated remote client to submit fabricated access-list entries that inflate the fee-payer's intrinsic gas cost. At the demonstrated default of 137 fabricated entries and 100 Gwei max_fee_per_gas, the fee-payer cost rises from approximately 51,287 gas to approximately 380,087 gas - a 7.4× multiplier - with no corresponding on-chain work, degrading the sponsor's operating margin. Affected versions: - >= 0.2.0, < 0.6.0 We recommend updating to: 0.6.0. CVSS 8.3 · our assessment: this_week Vendor advisory: https://github.com/ZenHive/mpp/security/advisories/GHSA-qpxh-ff8m-c62v Details: https://vuln.today/cve/CVE-2026-59694