PT-2026-28608 · Mppx · Mppx

Samczsun + 1 · Published 2026-03-29 · Updated 2026-03-31 · CVE-2026-34210

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions mppx versions prior to 0.4.11

Description mppx is a TypeScript interface for machine payments protocol. The stripe/charge payment method did not validate Stripe's Idempotent-Replayed response header when creating PaymentIntents. This allowed an attacker to replay a valid credential containing the same spt token against a new challenge, and the server would accept the replayed Stripe PaymentIntent as a new successful payment without actually charging the customer again. This enabled an attacker to pay once and consume unlimited resources by replaying the credential. The affected API endpoint is the stripe/charge payment method.

Recommendations Update to version 0.4.11 or later.

Exploit

Fix

Weakness Enumeration

CWE-697

Related Identifiers

CVE-2026-34210

GHSA-8MHJ-RFFC-RCVW

Affected Products

Mppx

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34210.json · Exploit
• https://github.com/wevm/mppx/commit/b2b1a0b60506fc71aa80b8a025084949dca1a994 · Patch
• https://github.com/wevm/mppx/security/advisories/GHSA-8mhj-rffc-rcvw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34210 · Security Note
• https://osv.dev/vulnerability/GHSA-8mhj-rffc-rcvw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-34210 · Vendor Advisory
• https://github.com/wevm/mppx · Note
• https://github.com/wevm/mppx/releases/tag/mppx%400.4.11 · Note
• https://github.com/wevm/mppx/releases/tag/mppx@0.4.11 · Note
• https://twitter.com/CVEnew/status/2039004446605152579 · Twitter Post