PT-2026-31362 · Crates.Io · Mpp

Published 2026-03-29 · Updated 2026-03-29

OSV

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N

Impact

Multiple vulnerabilities were discovered which allowed for undesirable behaviors, including:

• Performing free tempo/charge requests
• Replaying existing tempo/charge requests
• Performing free tempo/session requests
• Piggybacking off existing tempo/session channels
• Griefing existing tempo/session channels
• Manipulate the fee payer of a tempo/charge or tempo/session handler into paying for requests
• Replaying existing stripe/charge requests

Patches

The issues are patched in 0.8.0

Workarounds

There are no workarounds available for these vulnerabilities

Fix

Insufficient Verification of Data Authenticity

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-345

CWE-288

CWE-294

Related Identifiers

GHSA-FXC9-7J2W-VX54

Affected Products

Mpp

References · 4

• https://osv.dev/vulnerability/GHSA-fxc9-7j2w-vx54 · Vendor Advisory
• https://github.com/tempoxyz/mpp-rs/security/advisories/GHSA-fxc9-7j2w-vx54 · Note
• https://github.com/tempoxyz/mpp-rs/releases/tag/v0.8.0 · Note
• https://github.com/tempoxyz/mpp-rs · Note