EEF-CVE-2026-59695
- Source
- https://cna.erlef.org/osv/EEF-CVE-2026-59695.html
- Import Source
- https://cna.erlef.org/osv/EEF-CVE-2026-59695.json
- JSON Data
- https://api.osv.dev/v1/vulns/EEF-CVE-2026-59695
- Aliases
-
- CVE-2026-59695
- GHSA-vv77-66rf-pm86
- Published
- 2026-07-17T10:11:43.674Z
- Modified
- 2026-07-17T10:26:40.661585865Z
- Severity
-
- 8.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Unbounded max_fee_per_gas in mpp Tempo fee-payer enables single-request wallet drain
- Details
-
Summary
Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet in a single request by naming an arbitrarily high gas price.
When the mpp Elixir library is configured as fee payer (fee_payer: true), MPP.Tempo.Transaction.cosign_fee_payer/3 re-signs the client-supplied base fields of the 0x76 AASigned envelope verbatim, including max_fee_per_gas and max_priority_fee_per_gas, without validating that they are within reasonable bounds. A malicious client embeds arbitrarily large values for these fields in the signed envelope. The server co-signs and broadcasts the transaction. The effective_gas_price billed against the fee-payer wallet is derived from the attacker-supplied ceilings, so the server pays those inflated per-gas rates out of its own wallet. A single crafted request can drain the wallet entirely, after which the server can no longer sponsor gas for legitimate payment requests.
This issue affects mpp: from 0.2.0 before 0.6.0.
Configuration
The vulnerable code path is only reachable when the MPP.Methods.Tempo method is configured with fee_payer: true (server-side gas sponsorship). Default deployments with fee_payer: false are not affected, since the client pays for gas out of its own wallet.
- Database specific
{ "cwe_ids": [ "CWE-1284" ], "capec_ids": [ "CAPEC-130" ], "cpe_ids": [ "cpe:2.3:a:ZenHive:mpp:*:*:*:*:*:*:*:*" ] }- References
- Credits
-
-
- Kian Kai Ang - FINDER
-
- E.FU - REMEDIATION_DEVELOPER
-
- Jonatan Männchen / EEF - ANALYST
-
Affected packages
Hex / mpp
Package
- Name
- mpp
- Purl
- pkg:hex/mpp