CVE-2026-34209

Katalog CVE

CVSS 7.5 · High EPSS 0,44%

Kerentanan Authentication Bypass by Capture-replay pada wevm mppx. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

mppx is a TypeScript interface for machine payments protocol. Prior to version 0.4.11, the tempo/session cooperative close handler validated the close voucher amount using "<" instead of "<=" against the on-chain settled amount. An attacker could submit a close voucher exactly equal to the settled amount, which would be accepted without committing any new funds, effectively closing or griefing the channel for free. This issue has been patched in version 0.4.11.

Rincian

Terbit di NVD

31 Maret 2026

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-294: Authentication Bypass by Capture-replay

EPSS (30 hari)

0,44% peluang dieksploitasi; lebih tinggi dari 36,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/wevm/mppx/security/advisories/GHSA-mv9j-8jvg-j8mr patch · advisory vendor
• https://github.com/wevm/mppx/commit/94088246ee18f21b5d6be40d9e7a464f5a280bfb patch
• https://github.com/wevm/mppx/releases/tag/mppx@0.4.11 release notes