GitHub Advisoryadvisory · crates.io

GHSA-fxc9-7j2w-vx54 mpp has multiple payment bypass and griefing vulnerabilities

CRITICAL Published 2026-03-29 Modified 2026-03-29 Official page ↗
Ecosystem
crates.io
Packages
mpp
Severity
Critical
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N
Weaknesses
CWE-288, CWE-294, CWE-345
Reviewed
2026-03-29

Affected packages

• crates.io mpp: < 0.8.0 → fixed in 0.8.0

Description

Impact Multiple vulnerabilities were discovered which allowed for undesirable behaviors, including: • Performing free `tempo/charge` requests • Replaying existing `tempo/charge` requests • Performing free `tempo/session` requests • Piggybacking off existing `tempo/session` channels • Griefing existing `tempo/session` channels • Manipulate the fee payer of a `tempo/charge` or `tempo/session` handler into paying for requests • Replaying existing `stripe/charge` requests Patches The issues are patched in 0.8.0 Workarounds There are no workarounds available for these vulnerabilities

Related

Weakness · CWE (3)

  • CWE-288 Authentication Bypass Using an Alternate Path or Channel weakness
  • CWE-294 Authentication Bypass by Capture-replay weakness
  • CWE-345 Insufficient Verification of Data Authenticity weakness

References