CVE-2026-82751

ZenHive mpp, which lets a server sponsor (pay the gas for) clients' Tempo payments, fails to validate the optional key_authorization field in client-signed 0x76 envelopes: the FeePayerPolicy.measure/3 routine bounds the gas fields, fee budget, validity window and access list, but never checks whether that field is present. An unauthenticated remote client can attach a fully signed key authorization — provisioning a new access key with token spending limits on its own account — alongside an ordinary sponsored payment, and the key plus each spending-limit entry is billed to the sponsor as intrinsic gas, bounded only by the gas_limit ceiling. At the reporter's default of one key with three token limits, the sponsor's cost rises from about 46,587 to about 1,808,700 gas (roughly a 39x increase), and the client ends up with a valid access key it paid nothing for. Any operator running mpp in the affected range (all versions from 0.2.0 before 0.16.1) to sponsor Tempo payments can be repeatedly overbilled this way. No public proof-of-concept is known, the flaw is not listed in CISA's KEV, and EPSS estimates only a 0.3% chance of exploitation within 30 days.

What to do: Upgrade mpp to version 0.16.1 or later. As an interim mitigation, tighten the sponsored gas_limit ceiling, since the overbilling is bounded only by that limit, and review any access keys provisioned on client accounts through sponsored payments, as clients may have obtained valid keys at the sponsor's expense.