CVE-2026-89420

Improper Validation of Specified Quantity in Input in ZenHive mpp allows a client holding an open payment channel to obtain paid resources without being charged. MPP.Session.Actions.accept_voucher/3 in lib/mpp/session/actions.ex treats a voucher whose cumulativeAmount equals the channel's already-accepted cumulative amount as an idempotent success, returning the channel unchanged without calling maybe_spend/2. The credential verifies, the protected resource is served, and spent and units stay where they were. Because the server issues a fresh challenge per request and the credential replay store keys on challenge id and payload, the same signed voucher can be re-presented under every new challenge, so one paid voucher yields an unbounded number of paid units. The path is reachable from any method built on MPP.Session.Method through the Plug, MCP, JSON-RPC and WebSocket transports. This issue affects mpp: from 0.14.0 before 0.16.2.

• CWE-1284

• https://cna.erlef.org/cves/CVE-2026-89420.html
• https://github.com/ZenHive/mpp/commit/7270edc1dcfb58250cc5ee812876609206564165
• https://github.com/ZenHive/mpp/commit/82df569c898be1137189e3648e1edb4af6363651
• https://github.com/ZenHive/mpp/security/advisories/GHSA-8c63-r789-xrrf
• https://osv.dev/vulnerability/EEF-CVE-2026-89420
• https://github.com/ZenHive/mpp/security/advisories/GHSA-8c63-r789-xrrf

Published

Sep 22, 2026

Last Modified

Sep 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-89407NumberInput.looksLikeValidNumber() in FasterXML jackson-core…7.5
• CVE-2026-8941The CDN Linker lite plugin for WordPress is vulnerable to Cr…4.3
• CVE-2026-89412The TranslatePress – Translate Multilingual sites with AI Tr…7.2
• CVE-2026-89413The Filter Gallery plugin for WordPress is vulnerable to aut…8.1
• CVE-2026-89418google-protobuf contains an unbounded recursion when parsing…8.7
• CVE-2026-8942The MetaMagic SEO Plugin plugin for WordPress is vulnerable …4.3
• CVE-2026-89422Key Exchange without Entity Authentication vulnerability in …9.3
• CVE-2026-89425UTF8DataInputJsonParser._reportInvalidToken() in FasterXML j…7.5
• CVE-2026-8943The GoStats for WordPress plugin for WordPress is vulnerable…4.3
• CVE-2026-89436In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-89437In the Linux kernel, the following vulnerability has been re…
• CVE-2026-89438In the Linux kernel, the following vulnerability has been re…