Threats tagged 'ghsa-vrg5-xm7q-qcjh'

CVE-2026-67581 is an authentication bypass vulnerability in ZenHive mpp versions from 0.3.0 before 0.6.3. It allows an unauthenticated remote attacker to reuse a previously settled on-chain transfer to obtain paid resources without authorization. The vulnerability arises because the verification method accepts a transaction hash credential and matches transfers based only on token, recipient, and amount, without binding the proof to the specific challenge or preventing reuse. This enables replay attacks using publicly visible blockchain transactions.