The vulnerability in ZenHive mpp involves the type="hash" credential path in MPP.Methods.Tempo.verify/2, which performs a non-atomic sequence of checking if a payment hash is unused, verifying the payment on-chain, and then marking the hash as used. Because these steps are not atomic, concurrent requests with the same payment hash can all pass the unused check before any write occurs, allowing multiple redemptions of a single payment. Although an atomic check_and_mark/2 primitive exists and is used by the type="transaction" path, the hash path does not utilize it even when available. Exploitation requires a configured dedup store; the default nil store does not provide replay protection. This affects mpp versions from 0.2.0 before 0.6.1.

An unauthenticated remote attacker can exploit this race condition to redeem a single confirmed on-chain payment multiple times, effectively bypassing intended payment restrictions and gaining unauthorized multiple accesses to paid resources. This could lead to financial loss or resource misuse. There is no indication of privilege escalation or system compromise beyond the payment replay issue.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or not configuring a dedup store for the hash credential path to avoid replay protection issues, or use the type="transaction" path which uses atomic operations. Monitor vendor communications for an official fix or update.