CVE-2026-34210CWE-697

mppx has Stripe charge credential replay via missing idempotency check

Medium · published March 31, 2026

CVSS v4.0
6.0
EPSS
1%
Percentile
46.6
In the wild
Unconfirmed
What it is

mppx is a TypeScript interface for machine payments protocol. Prior to version 0.4.11, the stripe/charge payment method did not check Stripe's Idempotent-Replayed response header when creating PaymentIntents. An attacker could replay a valid credential containing the same spt token against a new challenge, and the server would accept the replayed Stripe PaymentIntent as a new successful payment without actually charging the customer again. This allowed an attacker to pay once and consume unlimited resources by replaying the credential. This issue has been patched in version 0.4.11.

The record
Technical detail
CVSS v4.0
6.0 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00573 · 46.6th percentile
Weakness
CWE-697 · Incorrect Comparison
Published
2026-03-31T14:10Z
EPSS history
Timeline
  • 31 MAR 14:10Z
    mppx has Stripe charge credential replay via missing idempotency check
    cvelistv5