PT-2026-28608 · Mppx · Mppx

Samczsun + 1 · Publicado 2026-03-29 · Atualizado 2026-03-31 · CVE-2026-34210

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions mppx versions prior to 0.4.11

Description mppx is a TypeScript interface for machine payments protocol. The stripe/charge payment method did not validate Stripe's Idempotent-Replayed response header when creating PaymentIntents. This allowed an attacker to replay a valid credential containing the same spt token against a new challenge, and the server would accept the replayed Stripe PaymentIntent as a new successful payment without actually charging the customer again. This enabled an attacker to pay once and consume unlimited resources by replaying the credential. The affected API endpoint is the stripe/charge payment method.

Recommendations Update to version 0.4.11 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-697

Identificadores relacionados

CVE-2026-34210

GHSA-8MHJ-RFFC-RCVW

Produtos afetados

Mppx

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34210.json · Exploit
• https://github.com/wevm/mppx · Nota
• https://github.com/wevm/mppx/commit/b2b1a0b60506fc71aa80b8a025084949dca1a994 · Correção
• https://github.com/wevm/mppx/releases/tag/mppx%400.4.11 · Nota
• https://github.com/wevm/mppx/security/advisories/GHSA-8mhj-rffc-rcvw · Aviso do Fabricante
• https://github.com/wevm/mppx/releases/tag/mppx@0.4.11 · Nota
• https://twitter.com/CVEnew/status/2039004446605152579 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-34210 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-8mhj-rffc-rcvw · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-34210 · Aviso do Fabricante