# mpp (Hex) vulnerabilities 13 known vulnerabilities (10 high, 3 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://hex.pm/packages/mpp ## Advisories (13) ### [CVE-2026-87119](https://cve.now/CVE-2026-87119): mpp Tempo subscription key authorization is not bound to the issuing challenge, allowing a captured activation credential to be replayed - Severity: High 8.2 - Published: Sep 22, 2026 - Affected: from 0.14.0, fixed in 0.16.2; from 0.14.0, fixed in 0.16.2. ### [CVE-2026-89420](https://cve.now/CVE-2026-89420): Session voucher adding no new funds is accepted without a charge in mpp, serving paid resources for free - Severity: High 7.1 - Published: Sep 22, 2026 - Affected: from 0.14.0, fixed in 0.16.2; from 0.14.0, fixed in 0.16.2. ### [CVE-2026-88255](https://cve.now/CVE-2026-88255): mpp Tempo keys its pre-broadcast dedup reserve on the caller-supplied transaction encoding, so a re-encoded signed transaction reserves a… - Severity: Medium 6.3 - Published: Sep 16, 2026 - Affected: from 0.2.0, fixed in 0.16.2; from 0.2.0, fixed in 0.16.2. ### [CVE-2026-89186](https://cve.now/CVE-2026-89186): mpp writes Payment-Receipt and Cache-Control before the wrapped application runs, letting a consumer's own Cache-Control expose paid… - Severity: Medium 6.3 - Published: Sep 16, 2026 - Affected: from 0.1.0, fixed in 0.16.2; from 0.1.0, fixed in 0.16.2. ### [CVE-2026-82750](https://cve.now/CVE-2026-82750): Unbounded EIP-7702 authorization list in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors account delegation - Severity: High 8.3 - Published: Sep 6, 2026 - Affected: from 0.2.0, fixed in 0.16.1; from 0.2.0, fixed in 0.16.1. ### [CVE-2026-82751](https://cve.now/CVE-2026-82751): Unbounded key authorization in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors access-key provisioning - Severity: High 8.3 - Published: Sep 6, 2026 - Affected: from 0.2.0, fixed in 0.16.1; from 0.2.0, fixed in 0.16.1. ### [CVE-2026-67581](https://cve.now/CVE-2026-67581): On-chain transfer proof is not single-use in mpp EVM payment method, enabling cross-challenge replay - Severity: High 8.7 - Published: Aug 19, 2026 - Affected: from 0.3.0, fixed in 0.6.3; from 0.3.0, fixed in 0.6.3. ### [CVE-2026-73541](https://cve.now/CVE-2026-73541): Tempo fee sponsorship in mpp bounds each transaction but not aggregate exposure, allowing concurrent sponsor-wallet drain - Severity: High 8.3 - Published: Aug 19, 2026 - Affected: from 0.2.0, fixed in 0.12.0; from 0.2.0, fixed in 0.12.0. ### [CVE-2026-73136](https://cve.now/CVE-2026-73136): Static memo configuration in mpp Tempo disables per-challenge attribution binding, enabling third-party replay - Severity: High 8.2 - Published: Aug 19, 2026 - Affected: from 0.6.1, fixed in 0.6.4; from 0.6.1, fixed in 0.6.4. ### [CVE-2026-73829](https://cve.now/CVE-2026-73829): Non-atomic hash-credential dedup in mpp Tempo allows replay of a confirmed payment under a concurrent race - Severity: Medium 6.3 - Published: Aug 19, 2026 - Affected: from 0.2.0, fixed in 0.6.1; from 0.2.0, fixed in 0.6.1. ### [CVE-2026-59252](https://cve.now/CVE-2026-59252): Missing gas\_limit validation in mpp Tempo fee-payer enables wallet drain - Severity: High 8.2 - Published: Jul 17, 2026 - Affected: from 0.2.0, fixed in 0.6.0; from 0.2.0, fixed in 0.6.0. ### [CVE-2026-59694](https://cve.now/CVE-2026-59694): Unbounded access list in mpp Tempo fee-payer inflates gas cost per payment - Severity: High 8.3 - Published: Jul 17, 2026 - Affected: from 0.2.0, fixed in 0.6.0; from 0.2.0, fixed in 0.6.0. ### [CVE-2026-59695](https://cve.now/CVE-2026-59695): Unbounded max\_fee\_per\_gas in mpp Tempo fee-payer enables single-request wallet drain - Severity: High 8.3 - Published: Jul 17, 2026 - Affected: from 0.2.0, fixed in 0.6.0; from 0.2.0, fixed in 0.6.0. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/hex/mpp Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.