These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-82751 Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored payment by a large multiplier and to have the sponsor pay for provisioning an access key on the client's own account. This issue affects mpp: from 0.2.0 before 0.16.1. The server sponsors Tempo payments, MPP.Methods.Tempo.FeePayerPolicy. [truncated]
CVE-2026-82750 Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored payment by a large multiplier and to have the sponsor pay for EIP-7702 account delegations of the client's choosing. This vulnerability affects mpp versions from 0.2.0 before 0.16.1. The issue arises from the server's sponsorship of Temp [truncated]
CVE-2026-73541 debrief: ZenHive Machine Payments Protocol fee-payer wallet denial of service via concurrent sponsored payments. The vulnerability allows unauthenticated remote clients to drain the fee-payer wallet by sending multiple transactions with distinct expiring nonces, causing denial of service to legitimate payers. Defenders should assess exposure and prioritize patching or compensating controls. [truncated]
CVE-2026-73136 is an authentication bypass vulnerability in ZenHive's Machine Payments Protocol (MPP) that allows an unauthenticated third party to obtain paid resources by replaying a transfer settled by an unrelated payer. The issue arises from a static 'memo' configuration in method_config, which can be exploited by an attacker to bypass authentication and gain access to paid resources. This vulnerabil [truncated]
CVE-2026-67581 is an authentication bypass vulnerability in ZenHive's Machine Payments Protocol (MPP). An unauthenticated remote client can obtain paid resources by resubmitting a settled on-chain transfer. The issue arises from MPP.Methods.EVM.verify/2 accepting a transaction-hash credential and matching a transfer based solely on token, recipient, and amount, without binding the proof to the challenge b [truncated]
CVE-2026-59695 is a vulnerability in ZenHive's mpp library that allows an unauthenticated remote client to drain the fee-payer wallet by naming an arbitrarily high gas price. The vulnerability is caused by the improper validation of specified quantity in input in the mpp library. When the library is configured as a fee payer, it re-signs client-supplied base fields of the 0x76 AASigned envelope verbatim, [truncated]
CVE-2026-59694 is a vulnerability in ZenHive's mpp library, which allows an unauthenticated remote client to inflate the fee-payer's gas cost per payment by a large multiplier, degrading the sponsor's operating margin. The vulnerability occurs when the mpp Elixir library is configured as a fee payer and re-signs the client-supplied base fields of the 0x76 AASigned envelope verbatim, including the EIP-2930 [truncated]
CVE-2026-59252 is an Improper Validation of Specified Quantity in Input vulnerability in ZenHive mpp that allows an unauthenticated remote client to drain the fee-payer wallet, resulting in denial of service for legitimate clients. The vulnerability affects mpp versions from 0.2.0 before 0.6.0. The issue arises when the mpp Elixir library is configured as a fee payer and does not validate the client-suppl [truncated]