ZenHive mpp EUVD-2026-62592

Exploitation requires a specific, non-default operator configuration: MPP.Methods.Tempo must be active and method_config must contain a static 'memo' string without a corresponding 'store' (deduplication) setting. This is the precise configuration that triggers the short-circuit in check_matched_memo_binding/3 and disables attribution nonce binding. Additionally, the attacker must be able to identify on-chain transfers that match the operator's expected token, recipient, and amount - all publicly observable on the Tempo blockchain. Exploitation is further bounded to mpp versions 0.6.1-0.6.3. The attack does NOT apply to deployments using the default no-memo configuration (where challenge-bound nonces prevent replay), deployments that have already added a 'store' dedup backend, or mpp versions 0.6.4 and later (where the misconfiguration is rejected at startup). No authentication, credentials, or wallet key material are required from the attacker.

The CVSS 4.0 score of 8.2 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N) reflects unauthenticated network exploitation with high integrity impact, moderated by AT:P - the specific attack requirement that the operator has configured a static memo without a dedup store. EPSS data is absent from the provided intelligence, and neither active exploitation (CISA KEV) nor public exploit code has been identified at time of analysis. The real-world risk is tightly scoped to configuration: deployments using the default no-memo (challenge-bound nonce) path are unaffected, which limits the blast radius meaningfully. Even a mid-sized operator in ustka running mpp with the static-memo Tempo configuration should treat this as urgent, since the entire payment enforcement layer can be defeated using only publicly observable blockchain data and standard HTTP calls - no credentials, cryptographic material, or privileged access required. The AT:P modifier in the CVSS 4.0 vector is well-calibrated: it captures the configuration dependency without understating the severity for operators who are in that configuration.

An attacker passively monitors the public Tempo blockchain and identifies a TransferWithMemo transaction that matches a target operator's configured recipient address, token type, required payment amount, and static memo string (the latter obtained for free from the operator's unauthenticated HTTP 402 challenge response). The attacker then initiates a fresh payment challenge against the same route and submits the legitimate customer's transaction hash as a type='hash' credential payload. Because the server only validates token, recipient, amount, and the static memo - performing no check that the presenter controls the sending wallet - access to the paid resource is granted without the attacker having made any payment.