Authentication Bypass Vulnerability in ZenHive mpp Software

CVE-2026-87119

What is CVE-2026-87119?

The vulnerability in ZenHive mpp allows an attacker to exploit a flaw in the authentication mechanism. By capturing a subscription activation credential, an attacker can repeatedly initiate charges to the payer's wallet without additional user interaction. The flaw arises due to the usage of static keys for verification of signed fields against subscription requests. This static key not only validates old credentials but also permits new challenges under the same subscription terms. As a result, each replay attempt can issue new charges and reauthorize the server key within the constraints of the subscription’s expiry and associated chain logic, severely jeopardizing user funds and subscription integrity.

References