CVE-2026-89420 Session voucher adding no new funds is accepted without a charge in mpp, serving paid resources for free

Improper Validation of Specified Quantity in Input in ZenHive mpp allows a client holding an open payment channel to obtain paid resources without being charged. MPP.Session.Actions.acceptvoucher/3 in lib/mpp/session/actions.ex treats a voucher whose cumulativeAmount equals the channel's...

CVE-2026-89420 Session voucher adding no new funds is accepted without a charge in mpp, serving paid resources for free

Improper Validation of Specified Quantity in Input in ZenHive mpp allows a client holding an open payment channel to obtain paid resources without being charged. MPP.Session.Actions.acceptvoucher/3 in lib/mpp/session/actions.ex treats a voucher whose cumulativeAmount equals the channel's...