An unauthenticated capture-replay vulnerability in ZenHive mpp allows attackers to perform unauthorized subscription activations and financial charges, posing a significant risk to user accounts.

This is an authentication bypass by capture-replay (CWE-294) occurring in the Tempo KeyAuthorization mechanism, where signed credentials lack a binding to the specific challenge issued by the server. An unauthenticated attacker can replay these credentials to trigger successful subscription activations repeatedly.

The exploitation of this vulnerability results in direct financial impact due to unauthorized, repetitive charges against a payer's wallet. With a CVSS score of 8.2, this is a high-severity issue that could lead to significant reputational damage for the service provider and financial losses for affected users. The ability to manipulate subscription states without legitimate authorization undermines the integrity of the entire payment processing workflow.

Immediate Action: Update the ZenHive mpp software to version 0.16.2 or later to include the necessary cryptographic binding fixes.

Proactive Monitoring: Review financial transaction logs for suspicious patterns of repeated subscription activations or multiple settlements occurring for the same user or subscription term.

Compensating Controls: While no specific WAF rule can fully mitigate this logic-based flaw, implementing stricter rate limiting on the subscription activation endpoint may help slow down automated replay attempts.

Public Exploit Available: Unknown.

Given the potential for direct financial fraud, this vulnerability presents a high risk to service integrity. Administrators must prioritize upgrading to version 0.16.2 immediately. Failure to patch allows attackers to exploit the lack of cryptographic nonces to repeatedly trigger subscription transactions, leading to unauthorized billing cycles.