The vulnerability in ZenHive mpp involves an authentication bypass via capture-replay of subscription activation credentials. The Tempo KeyAuthorization signs fields such as chain id, key type, key id, expiry, limits, and scopes but does not include the challenge that prompted the authorization. The verification pins these signed fields against the subscription request and a static per-endpoint server key, which is valid for all challenges with the same subscription terms. Because activations are deduplicated by challenge id, replaying a captured credential under a new challenge results in a new deduplication key, allowing the subscription activation to succeed repeatedly. Each replay causes a new charge to the payer's wallet and re-authorizes the server key, limited only by subscription expiry and chain rules. This affects versions >=0.14.0 and <0.16.2.

An attacker with a captured subscription activation credential can repeatedly replay it to cause multiple subscription activations and charge the payer's wallet multiple times. This leads to financial loss for the payer and unauthorized repeated use of subscription services until the subscription expires or chain rules prevent further activations.

No official patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using affected versions or restrict access to subscription activation credentials to prevent capture and replay.