The vulnerability in ZenHive mpp involves the MPP.Methods.Tempo component, which normally binds a settled TIP-20 TransferWithMemo to a specific verification challenge using an attribution nonce in the memo. When a static memo is configured, the binding check is bypassed, allowing any matching transfer with the static memo to be accepted unconditionally. Since the static memo is echoed in unauthenticated responses and transfers are public, an attacker can replay a legitimate customer's transfer hash as a credential without sender or signature verification, effectively bypassing authentication.

An unauthenticated attacker can obtain paid resources by replaying a transfer settled by an unrelated payer. This bypasses intended authentication controls, potentially leading to unauthorized access to services or resources that require payment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using static memo configurations in MPP.Methods.Tempo or implement additional verification to ensure binding between transfers and challenges. Monitor vendor communications for patches or updates.