CVE-2026-82751: CWE-1284 Improper Validation of Specified Quantity in Input in ZenHive mpp

The vulnerability arises from improper validation in the fee payer policy of ZenHive mpp's Tempo payments. The function MPP.Methods.Tempo.FeePayerPolicy.measure/3 bounds certain gas-related fields but does not verify if the optional key_authorization field is present in the client-signed envelope. This omission allows a client to attach a fully signed key authorization that provisions a new access key with token spending limits on their own account. Each key and limit entry results in persistent storage writes billed as intrinsic gas to the sponsor, significantly increasing the sponsored gas cost from approximately 46,587 gas to about 1,808,700 gas. The client gains a valid access key without paying for it. The affected versions are >=0.2.0 and <0.16.1.

An unauthenticated remote attacker can cause the sponsor of Tempo payments to incur substantially increased gas costs by attaching unauthorized key authorizations. This results in financial loss to the sponsor due to inflated gas fees and unauthorized provisioning of access keys on the attacker's account. The vulnerability does not require authentication and can be exploited remotely.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, users should monitor for updates from ZenHive and consider restricting sponsorship features or applying custom validation if feasible.