The vulnerability arises in the MPP.Session.Actions.accept_voucher/3 function within lib/mpp/session/actions.ex of ZenHive mpp. When a voucher's cumulativeAmount matches the channel's previously accepted cumulative amount, the function returns success without invoking the spending logic (maybe_spend/2). Since the server issues a new challenge per request and the replay store keys on challenge ID and payload, the same signed voucher can be reused indefinitely across new challenges. This flaw allows a client to obtain an unbounded number of paid units from a single voucher. The affected versions are from 0.14.0 up to but excluding 0.16.2. The vulnerability is reachable via multiple transport methods including Plug, MCP, JSON-RPC, and WebSocket.

An attacker holding an open payment channel can exploit this vulnerability to consume paid resources repeatedly without incurring additional charges. This leads to potential financial loss and resource exhaustion for the service provider. The vulnerability has a CVSS 4.0 base score of 7.1 (high severity), indicating a significant impact on confidentiality and integrity due to improper validation and replay of payment vouchers.

No explicit patch or remediation link is provided in the advisory. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting or monitoring usage of affected versions and avoid accepting vouchers under the vulnerable logic. Applying any official updates from ZenHive once released is recommended.