The mppx component of the wevm project had a validation flaw in its tempo/session cooperative close handler. It used a less-than comparison ('<') instead of a less-than-or-equal-to ('<=') check when validating the close voucher amount against the on-chain settled amount. This allowed an attacker to submit a close voucher exactly equal to the settled amount, which was accepted incorrectly, enabling channel closure or griefing without additional funds. This vulnerability is tracked as CVE-2026-34209 and is classified under CWE-294 (Authentication Bypass). It has a CVSS 3.1 score of 7.5 (high severity). The issue has been patched in version 0.4.11.

An attacker can close or grief a payment channel by submitting a close voucher equal to the settled amount without committing new funds. This results in denial of service or disruption of normal channel operations, impacting the integrity of payment settlements. There is no confidentiality or availability impact reported. No known exploits are currently in the wild.

Upgrade to version 0.4.11 or later of the wevm mppx interface, where the validation logic has been corrected to use a less-than-or-equal-to comparison. This patch effectively prevents the described authentication bypass and channel griefing. No additional mitigation is required once the update is applied.