Threats Tagged 'cve-2026-73829'

A Time-of-check Time-of-use (TOCTOU) race condition exists in ZenHive mpp that allows an unauthenticated remote client to redeem a single confirmed on-chain payment multiple times for paid-resource accesses. The vulnerability arises because the 'hash' credential verification path uses a non-atomic check-then-mark sequence, enabling concurrent requests with the same payment hash to bypass replay protection. This affects versions from 0.2.0 up to but not including 0.6.1. The default configuration does not provide replay protection, and exploitation requires a deduplication store to be configured.

Time-of-check Time-of-use (TOCTOU) Race Condition in ZenHive mpp allows an unauthenticated remote client to redeem one confirmed on-chain payment for multiple paid-resource accesses. The type="hash" credential path in MPP.Methods.Tempo.verify/2 guards against replay with a non-atomic check-then-mark sequence: check_hash_unused/2 reads the dedup store, an eth_getTransactionReceipt round trip verifies the payment on chain, and only then does mark_hash_used/2 write the mark. Concurrent requests carrying the same settled payment hash all pass the read before any of them writes, so each is issued a receipt. The store's atomic check_and_mark/2 primitive is available and used by the type="transaction" path, but the hash path calls plain get and put even when the configured store implements it. Exploitation requires a dedup store to be configured; the default nil store is stateless and documented as offering no replay protection at all. This issue affects mpp: from 0.2.0 before 0.6.1.