ZenHive mpp CVE-2026-82751

The server must be deployed and actively operating as a Tempo payment sponsor using MPP.Methods.Tempo.FeePayerPolicy, which is the specific subsystem that lacks key_authorization validation. No client authentication is required; any network-reachable client can submit a 0x76 envelope to the sponsor endpoint. The inflated gas cost scales with the number of key entries and token limit entries the attacker embeds - bounded only by the sponsor's configured max_gas ceiling. Exploitation is limited to mpp versions 0.2.0 through 0.16.0; mpp deployments not sponsoring Tempo payments are not exposed. The attacker must have basic knowledge of the Tempo 0x76 transaction envelope format to craft the malicious payload.

The CVSS 4.0 base score of 8.3 is grounded in a realistic vector: AV:N (network-accessible sponsor endpoint), AC:L (protocol is well-documented), AT:P (specific attack prerequisite - the server must be operating as a Tempo payment sponsor), PR:N (no client authentication), VI:H (financial integrity violation), VA:L (sponsor gas budget can be systematically drained). The AT:P attack prerequisite meaningfully limits the exposed population to deployed Tempo sponsor services, which is a niche segment even within the already-low-prevalence mpp ecosystem. There is no KEV listing and no separate POC repository, though the description supplies exact reproduction parameters (one key, three token limits, observed gas figures), making independent reproduction straightforward for anyone familiar with the Tempo protocol. The dual impact - financial drain on the sponsor and a permanently provisioned free access key for the attacker - elevates real-world impact beyond a simple DoS, as the access key represents a persistent artifact the attacker retains after the attack. No conflicting signals are present; CVSS vector and description are consistent.

An attacker who knows a Tempo sponsor endpoint is running a vulnerable mpp version constructs a 0x76 payment envelope embedding a fully signed key_authorization payload containing one access key and three token spending limits. When the attacker submits this envelope, the FeePayerPolicy validates gas, fee budget, and access list as normal but silently passes the key_authorization through, causing the server to co-sign and the sponsor to pay approximately 1,808,700 gas - roughly 39 times the expected cost - while the attacker's account is permanently provisioned with a new access key at no cost to the attacker.