CVE-2026-82750: CWE-1284 Improper Validation of Specified Quantity in Input in ZenHive mpp

The vulnerability in ZenHive mpp (CVE-2026-82750) is due to improper validation of the aa_authorization_list field in the client-signed 0x76 envelope used for Tempo payments. While other fields such as gas limits and fee budgets are bounded, the aa_authorization_list is not read or validated. Each signed delegation in this list is charged as intrinsic gas before the payment call executes. An attacker can attach multiple delegations from throwaway authority keys, causing the sponsor to pay a multiplied gas cost within the default gas limit. For example, with seven entries, the gas cost inflates from about 46,575 to approximately 1,884,087 gas. Additionally, each delegation acts as a persistent set-code delegation, allowing clients to upgrade their own accounts to delegated code at the sponsor's expense. This affects versions >=0.2.0 and <0.16.1 of ZenHive mpp.

An unauthenticated remote attacker can cause a sponsor to pay significantly inflated gas fees for sponsored payments by exploiting the lack of validation on the aa_authorization_list field. This leads to financial loss for the sponsor due to excessive gas consumption. Furthermore, the attacker can upgrade their own accounts to delegated code at the sponsor's cost, potentially enabling further unauthorized actions or privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, users should consider restricting or monitoring sponsored payment usage or avoid using affected versions. Vendors or maintainers should validate the aa_authorization_list field properly to prevent gas cost inflation.