Vulnerability-Lookup

CVE-2026-34209 (GCVE-0-2026-34209)

Vulnerability from cvelistv5 – Published: 2026-03-31 14:10 – Updated: 2026-04-02 15:13

Title

mppx: Tempo has a session close voucher bypass vulnerability due to settled amount equality

Summary

mppx is a TypeScript interface for machine payments protocol. Prior to version 0.4.11, the tempo/session cooperative close handler validated the close voucher amount using "<" instead of "<=" against the on-chain settled amount. An attacker could submit a close voucher exactly equal to the settled amount, which would be accepted without committing any new funds, effectively closing or griefing the channel for free. This issue has been patched in version 0.4.11.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-294 - Authentication Bypass by Capture-replay

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/wevm/mppx/security/advisories/…	x_refsource_CONFIRM
https://github.com/wevm/mppx/commit/94088246ee18f…	x_refsource_MISC
https://github.com/wevm/mppx/releases/tag/mppx@0.4.11	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
wevm	mppx	Affected: < 0.4.11

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-34209",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-02T15:13:21.208040Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-02T15:13:32.047Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "mppx",
          "vendor": "wevm",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.4.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "mppx is a TypeScript interface for machine payments protocol. Prior to version 0.4.11, the tempo/session cooperative close handler validated the close voucher amount using \"\u003c\" instead of \"\u003c=\" against the on-chain settled amount. An attacker could submit a close voucher exactly equal to the settled amount, which would be accepted without committing any new funds, effectively closing or griefing the channel for free. This issue has been patched in version 0.4.11."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-294",
              "description": "CWE-294: Authentication Bypass by Capture-replay",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-31T14:10:46.416Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/wevm/mppx/security/advisories/GHSA-mv9j-8jvg-j8mr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/wevm/mppx/security/advisories/GHSA-mv9j-8jvg-j8mr"
        },
        {
          "name": "https://github.com/wevm/mppx/commit/94088246ee18f21b5d6be40d9e7a464f5a280bfb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/wevm/mppx/commit/94088246ee18f21b5d6be40d9e7a464f5a280bfb"
        },
        {
          "name": "https://github.com/wevm/mppx/releases/tag/mppx@0.4.11",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/wevm/mppx/releases/tag/mppx@0.4.11"
        }
      ],
      "source": {
        "advisory": "GHSA-mv9j-8jvg-j8mr",
        "discovery": "UNKNOWN"
      },
      "title": "mppx: Tempo has a session close voucher bypass vulnerability due to settled amount equality"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-34209",
    "datePublished": "2026-03-31T14:10:46.416Z",
    "dateReserved": "2026-03-26T15:57:52.324Z",
    "dateUpdated": "2026-04-02T15:13:32.047Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-34209",
      "date": "2026-07-24",
      "epss": "0.00359",
      "percentile": "0.28391"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-34209\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-03-31T15:16:18.030\",\"lastModified\":\"2026-07-24T21:10:00.143\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"mppx is a TypeScript interface for machine payments protocol. Prior to version 0.4.11, the tempo/session cooperative close handler validated the close voucher amount using \\\"\u003c\\\" instead of \\\"\u003c=\\\" against the on-chain settled amount. An attacker could submit a close voucher exactly equal to the settled amount, which would be accepted without committing any new funds, effectively closing or griefing the channel for free. This issue has been patched in version 0.4.11.\"},{\"lang\":\"es\",\"value\":\"mppx es una interfaz TypeScript para el protocolo de pagos de m\u00e1quinas. Antes de la versi\u00f3n 0.4.11, el gestor de cierre cooperativo tempo/sesi\u00f3n validaba el monto del vale de cierre usando \u0027\u003c\u0027 en lugar de \u0027\u003c=\u0027 contra el monto liquidado en cadena. Un atacante podr\u00eda enviar un vale de cierre exactamente igual al monto liquidado, el cual ser\u00eda aceptado sin comprometer nuevos fondos, cerrando o griefing efectivamente el canal de forma gratuita. Este problema ha sido parcheado en la versi\u00f3n 0.4.11.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"wevm\",\"product\":\"mppx\",\"versions\":[{\"version\":\"\u003c 0.4.11\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-04-02T15:13:21.208040Z\",\"id\":\"CVE-2026-34209\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-294\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wevm:mppx:*:*:*:*:*:node.js:*:*\",\"versionEndExcluding\":\"0.4.11\",\"matchCriteriaId\":\"72D62258-34DE-453F-8DFC-D25FA285D537\"}]}]}],\"references\":[{\"url\":\"https://github.com/wevm/mppx/commit/94088246ee18f21b5d6be40d9e7a464f5a280bfb\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/wevm/mppx/releases/tag/mppx@0.4.11\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/wevm/mppx/security/advisories/GHSA-mv9j-8jvg-j8mr\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2026-04-01T17:03:21+00:00",
      "cve": "CVE-2026-34209",
      "id": "CVE-2026-34209",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "mppx: Tempo has a session close voucher bypass vulnerability due to settled amount equality",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34209.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-34209\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-02T15:13:21.208040Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-02T15:13:26.917Z\"}}], \"cna\": {\"title\": \"mppx: Tempo has a session close voucher bypass vulnerability due to settled amount equality\", \"source\": {\"advisory\": \"GHSA-mv9j-8jvg-j8mr\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"wevm\", \"product\": \"mppx\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 0.4.11\"}]}], \"references\": [{\"url\": \"https://github.com/wevm/mppx/security/advisories/GHSA-mv9j-8jvg-j8mr\", \"name\": \"https://github.com/wevm/mppx/security/advisories/GHSA-mv9j-8jvg-j8mr\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/wevm/mppx/commit/94088246ee18f21b5d6be40d9e7a464f5a280bfb\", \"name\": \"https://github.com/wevm/mppx/commit/94088246ee18f21b5d6be40d9e7a464f5a280bfb\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/wevm/mppx/releases/tag/mppx@0.4.11\", \"name\": \"https://github.com/wevm/mppx/releases/tag/mppx@0.4.11\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"mppx is a TypeScript interface for machine payments protocol. Prior to version 0.4.11, the tempo/session cooperative close handler validated the close voucher amount using \\\"\u003c\\\" instead of \\\"\u003c=\\\" against the on-chain settled amount. An attacker could submit a close voucher exactly equal to the settled amount, which would be accepted without committing any new funds, effectively closing or griefing the channel for free. This issue has been patched in version 0.4.11.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-294\", \"description\": \"CWE-294: Authentication Bypass by Capture-replay\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-03-31T14:10:46.416Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-34209\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-02T15:13:32.047Z\", \"dateReserved\": \"2026-03-26T15:57:52.324Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-03-31T14:10:46.416Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-34209

Vulnerability from fkie_nvd - Published: 2026-03-31 15:16 - Updated: 2026-06-17 10:38

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/wevm/mppx/commit/94088246ee18f21b5d6be40d9e7a464f5a280bfb	Patch
security-advisories@github.com	https://github.com/wevm/mppx/releases/tag/mppx@0.4.11	Release Notes
security-advisories@github.com	https://github.com/wevm/mppx/security/advisories/GHSA-mv9j-8jvg-j8mr	Patch, Vendor Advisory

Impacted products

	Vendor	Product	Version
	wevm	mppx	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "mppx",
          "vendor": "wevm",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.4.11"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wevm:mppx:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "72D62258-34DE-453F-8DFC-D25FA285D537",
              "versionEndExcluding": "0.4.11",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "mppx is a TypeScript interface for machine payments protocol. Prior to version 0.4.11, the tempo/session cooperative close handler validated the close voucher amount using \"\u003c\" instead of \"\u003c=\" against the on-chain settled amount. An attacker could submit a close voucher exactly equal to the settled amount, which would be accepted without committing any new funds, effectively closing or griefing the channel for free. This issue has been patched in version 0.4.11."
    }
  ],
  "id": "CVE-2026-34209",
  "lastModified": "2026-06-17T10:38:39.340",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-34209",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-04-02T15:13:21.208040Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-03-31T15:16:18.030",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/wevm/mppx/commit/94088246ee18f21b5d6be40d9e7a464f5a280bfb"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/wevm/mppx/releases/tag/mppx@0.4.11"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/wevm/mppx/security/advisories/GHSA-mv9j-8jvg-j8mr"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-294"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-MV9J-8JVG-J8MR

Vulnerability from github – Published: 2026-03-29 15:10 – Updated: 2026-03-31 18:51

Summary

mppx: Tempo has a session close voucher bypass vulnerability due to settled amount equality

Details

Impact

The tempo/session cooperative close handler validated the close voucher amount using < instead of <= against the on-chain settled amount. An attacker could submit a close voucher exactly equal to the settled amount, which would be accepted without committing any new funds, effectively closing or griefing the channel for free.

Patches

Fixed in 0.4.11.

Workarounds

There are no workarounds available for this vulnerability.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "mppx"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.4.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-34209"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-294"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-29T15:10:03Z",
    "nvd_published_at": "2026-03-31T15:16:18Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nThe `tempo/session` cooperative close handler validated the close voucher amount using `\u003c` instead of `\u003c=` against the on-chain settled amount. An attacker could submit a close voucher exactly equal to the settled amount, which would be accepted without committing any new funds, effectively closing or griefing the channel for free.\n\n### Patches\n\nFixed in 0.4.11.\n\n### Workarounds\n\nThere are no workarounds available for this vulnerability.",
  "id": "GHSA-mv9j-8jvg-j8mr",
  "modified": "2026-03-31T18:51:04Z",
  "published": "2026-03-29T15:10:03Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/wevm/mppx/security/advisories/GHSA-mv9j-8jvg-j8mr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34209"
    },
    {
      "type": "WEB",
      "url": "https://github.com/wevm/mppx/commit/94088246ee18f21b5d6be40d9e7a464f5a280bfb"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/wevm/mppx"
    },
    {
      "type": "WEB",
      "url": "https://github.com/wevm/mppx/releases/tag/mppx@0.4.11"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "mppx: Tempo has a session close voucher bypass vulnerability due to settled amount equality"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-34209 (GCVE-0-2026-34209)

FKIE_CVE-2026-34209

GHSA-MV9J-8JVG-J8MR

Impact

Patches

Workarounds

Tags

Sightings

Nomenclature