CVE-2026-87119 mpp Tempo subscription key authorization is not bound to the issuing challenge, allowing a captured activation credential to be replayed

[
  {
    "collectionURL": "https://repo.hex.pm",
    "cpes": [
      "cpe:2.3:a:ZenHive:mpp:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "'Elixir.MPP.Methods.Tempo.KeyAuthorization'",
      "'Elixir.MPP.Methods.Tempo.Subscription'"
    ],
    "packageName": "mpp",
    "packageURL": "pkg:hex/mpp",
    "product": "mpp",
    "programFiles": [
      "lib/mpp/methods/tempo/key_authorization.ex",
      "lib/mpp/methods/tempo/subscription.ex"
    ],
    "programRoutines": [
      {
        "name": "'Elixir.MPP.Methods.Tempo.KeyAuthorization':verify/3"
      },
      {
        "name": "'Elixir.MPP.Methods.Tempo.KeyAuthorization':wallet_params/2"
      },
      {
        "name": "'Elixir.MPP.Methods.Tempo.KeyAuthorization':from_rpc/1"
      },
      {
        "name": "'Elixir.MPP.Methods.Tempo.Subscription':verify/2"
      }
    ],
    "repo": "https://github.com/ZenHive/mpp",
    "vendor": "ZenHive",
    "versions": [
      {
        "lessThan": "0.16.2",
        "status": "affected",
        "version": "0.14.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "collectionURL": "https://github.com",
    "cpes": [
      "cpe:2.3:a:ZenHive:mpp:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "'Elixir.MPP.Methods.Tempo.KeyAuthorization'",
      "'Elixir.MPP.Methods.Tempo.Subscription'"
    ],
    "packageName": "zenhive/mpp",
    "packageURL": "pkg:github/zenhive/mpp",
    "product": "mpp",
    "programFiles": [
      "lib/mpp/methods/tempo/key_authorization.ex",
      "lib/mpp/methods/tempo/subscription.ex"
    ],
    "programRoutines": [
      {
        "name": "'Elixir.MPP.Methods.Tempo.KeyAuthorization':verify/3"
      },
      {
        "name": "'Elixir.MPP.Methods.Tempo.KeyAuthorization':wallet_params/2"
      },
      {
        "name": "'Elixir.MPP.Methods.Tempo.KeyAuthorization':from_rpc/1"
      },
      {
        "name": "'Elixir.MPP.Methods.Tempo.Subscription':verify/2"
      }
    ],
    "repo": "https://github.com/ZenHive/mpp",
    "vendor": "ZenHive",
    "versions": [
      {
        "lessThan": "4b6eaec02af0e8485cfb4ff68f467d075ed5dd6f",
        "status": "affected",
        "version": "db464dfa9a86ccda58f0827101f6da6bd8aafa78",
        "versionType": "git"
      }
    ]
  }
]