VulnerabilityAnalyzed

CVE-2026-34210

An attacker could replay a valid credential containing the same spt token against a new challenge, and the server would accept the replayed Stripe PaymentIntent as a new successful payment without actually charging the customer again.

MEDIUM 6.0EPSS 0.49%

Does this matter?

Lower severity and a low EPSS score (0.49%). Track it; it rarely justifies an emergency change on its own.

Description

mppx is a TypeScript interface for machine payments protocol. Prior to version 0.4.11, the stripe/charge payment method did not check Stripe's Idempotent-Replayed response header when creating PaymentIntents. An attacker could replay a valid credential containing the same spt token against a new challenge, and the server would accept the replayed Stripe PaymentIntent as a new successful payment without actually charging the customer again. This allowed an attacker to pay once and consume unlimited resources by replaying the credential. This issue has been patched in version 0.4.11.

CVSS 4.0: 6.0 MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.49% probability · 41th percentile
CISA KEV: Not listed
Weakness: CWE-697
Affected: wevm/mppx
Source: security-advisories@github.com

References

https://github.com/wevm/mppx/commit/b2b1a0b60506fc71aa80b8a025084949dca1a994Patch
https://github.com/wevm/mppx/releases/tag/mppx@0.4.11Release Notes
https://github.com/wevm/mppx/security/advisories/GHSA-8mhj-rffc-rcvwPatch, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.