The vulnerability involves the use of a shared HTTP cache that stores a paid response along with its Payment-Receipt header and serves it to clients who have not paid. The mpp library's Plug.verify_credential function sets payment-receipt and cache-control: private headers before the application runs but does not register a before_send callback to enforce these headers. Since Plug.Conn.put_resp_header/3 replaces existing headers, an application can override the cache-control header to a public value, enabling CDNs or reverse proxies to cache and serve paid content to unpaid clients. Additionally, non-2xx responses may still carry a Payment-Receipt header, issuing receipts for responses that delivered no resource. This affects mpp versions >=0.1.0 and <0.16.2.

Unauthorized clients may receive paid content cached by shared HTTP caches, potentially leading to unauthorized access to paid resources. Payment receipts may be issued incorrectly for responses that did not deliver content, undermining the integrity of payment verification.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, applications using mpp should avoid overriding the cache-control header set by the library or implement additional controls to prevent caching of paid responses in shared caches.