CVE-2026-89420

Improper Validation of Specified Quantity in Input in ZenHive mpp allows a client holding an open payment channel to obtain paid resources without being charged. MPP.Session.Actions.acceptvoucher/3 in lib/mpp/session/actions.ex treats a voucher whose cumulativeAmount equals the channel's...

CVE-2026-89420

ZenHive mpp (an Elixir payment-channel library) contains an improper quantity validation in MPP.Session.Actions.accept_voucher/3. A voucher whose cumulativeAmount equals the channel's already-accepted amount is treated as an idempotent success without decrementing the balance. Because the replay ...