CVE-2026-87119

Authentication Bypass by Capture-replay in ZenHive mpp allows an attacker holding a captured subscription activation credential to charge the payer repeatedly. The payer signs a Tempo KeyAuthorization over the chain id, key type, key id, expiry, limits and scopes only, with nothing tying it to th...

EUVD-2026-84361

Authentication Bypass by Capture-replay in ZenHive mpp allows an attacker holding a captured subscription activation credential to charge the payer repeatedly. The payer signs a Tempo KeyAuthorization over the chain id, key type, key id, expiry, limits and scopes only, with nothing tying it to th...

CVE-2026-87119 mpp Tempo subscription key authorization is not bound to the issuing challenge, allowing a captured activation credential to be replayed

Authentication Bypass by Capture-replay in ZenHive mpp allows an attacker holding a captured subscription activation credential to charge the payer repeatedly. The payer signs a Tempo KeyAuthorization over the chain id, key type, key id, expiry, limits and scopes only, with nothing tying it to th...

CVE-2026-87119

CVE-2026-87119 is an authentication bypass by capture-replay in ZenHive mpp (Elixir), affecting versions 0.14.0 through 0.16.1 . The root cause lies in MPP.Methods.Tempo.KeyAuthorization.verify/3: the payer signs a Tempo KeyAuthorization over the chain id, key type, key id, expiry, limits, and sc...

EEF-CVE-2026-87119 mpp Tempo subscription key authorization is not bound to the issuing challenge, allowing a captured activation credential to be replayed

Summary Authentication Bypass by Capture-replay in ZenHive mpp allows an attacker holding a captured subscription activation credential to charge the payer repeatedly. The payer signs a Tempo KeyAuthorization over the chain id, key type, key id, expiry, limits and scopes only, with nothing tying ...

PT-2026-96708

Name of the Vulnerable Software and Affected Versions ZenHive mpp versions 0.14.0 through 0.16.1 Description An authentication bypass via capture-replay allows an attacker with a captured subscription activation credential to repeatedly charge a payer. The issue occurs because the payer signs a...