CVE-2026-82750

ZenHive mpp, server-side software that sponsors (fee-pays) Tempo network payments, fails to read or bound the aa_authorization_list field of the client-signed 0x76 payment envelope, even though its FeePayerPolicy measure/3 routine caps the gas fields, fee budget, validity window, and access list (CWE-1284). An unauthenticated remote client can attach an arbitrary number of signed delegations from throwaway authority keys, and each entry is charged as intrinsic gas before the payment call runs, letting the attacker inflate the sponsor's cost roughly 40-fold - from about 46,575 gas to about 1,884,087 gas at the reporter's default of seven entries - all within the default gas_limit ceiling. Because each entry is also applied as a persistent set-code delegation, the attacker additionally gets the sponsor to pay for EIP-7702 delegations of the attacker's choosing, effectively upgrading attacker-controlled accounts to delegated code at the sponsor's expense. Any operator running mpp versions 0.2.0 through 0.16.0 to sponsor Tempo payments is affected. No public proof-of-concept, CISA KEV listing, or in-the-wild exploitation is known; EPSS estimates about a 0.3% probability of exploitation within 30 days.

What to do: Upgrade mpp to version 0.16.1 or later, which is the first release outside the affected range. Until patched, operators of Tempo payment-sponsoring services should monitor fee-payer balances for inflated gas charges, consider tightening the per-payment gas_limit below the default ceiling or restricting which clients can sponsor payments, and review sponsored accounts for unexpected set-code (EIP-7702) delegations. No public PoC or in-the-wild exploitation is currently known, but sponsors pay real value, so treat this as a fiscal-integrity fix and patch promptly.