The vulnerability arises from the Tempo duplicate-submission gate in ZenHive mpp's MPP.Methods.Tempo component, which reserves a deduplication slot keyed on the caller-supplied raw hex transaction rather than a canonical form. Because the deserializer accepts both recovery-id encodings (v=27 and v=0) verbatim, submitting the same signed transaction with these two encodings produces two distinct reserve keys. Both keys pass the reserve check and reach the broadcast path, allowing duplicate submissions. Depending on the node behavior, this can either cause a nonce-reuse rejection or result in a second valid payment receipt for the same on-chain payment. The plug-level credential replay store excludes this case, leaving the reserve as the only gate, which is bypassed due to this input validation flaw.

An unauthenticated remote attacker can submit the same signed transaction twice with different recovery-id encodings, bypassing the duplicate-submission gate. This can lead to either a rejection due to nonce reuse or issuance of multiple valid payment receipts for a single payment, potentially causing confusion or double acknowledgment of payments. The vulnerability does not allow direct chain state manipulation but can affect transaction processing integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates. No vendor advisory or patch links are currently provided.