Threats tagged 'ghsa-cw4v-5gcf-x3cw'

CVE-2026-73136 is an authentication bypass vulnerability in ZenHive mpp versions 0.6.1 up to but not including 0.6.4. It allows an unauthenticated attacker to replay a previously settled transfer to obtain paid resources without authorization. The flaw arises because a static memo configuration disables proper binding of transfers to authentication challenges, enabling replay attacks using public transfer data.