CVE-2026-34209CWE-294

mppx: Tempo has a session close voucher bypass vulnerability due to settled amount equality

High · published March 31, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
36.9
In the wild
Unconfirmed
What it is

mppx is a TypeScript interface for machine payments protocol. Prior to version 0.4.11, the tempo/session cooperative close handler validated the close voucher amount using "<" instead of "<=" against the on-chain settled amount. An attacker could submit a close voucher exactly equal to the settled amount, which would be accepted without committing any new funds, effectively closing or griefing the channel for free. This issue has been patched in version 0.4.11.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00436 · 36.9th percentile
Weakness
CWE-294 · Authentication Bypass by Capture-replay
Published
2026-03-31T14:10Z
EPSS history
Timeline
  • 31 MAR 14:10Z
    mppx: Tempo has a session close voucher bypass vulnerability due to settled amount equality
    cvelistv5