CVE-2026-34209: mppx Auth Bypass Vulnerability

CVE-2026-34209 Overview

CVE-2026-34209 is an authentication bypass vulnerability in mppx, a TypeScript interface for the machine payments protocol. Prior to version 0.4.11, the tempo/session cooperative close handler validated the close voucher amount using an improper comparison operator (< instead of <=) against the on-chain settled amount. This flaw allows an attacker to submit a close voucher exactly equal to the settled amount, which would be accepted without committing any new funds, effectively closing or griefing the channel for free.

Critical Impact

Attackers can exploit this boundary condition error to close payment channels without committing funds, enabling channel griefing attacks that disrupt legitimate financial operations.

Affected Products

• mppx versions prior to 0.4.11

Discovery Timeline

• 2026-03-31 - CVE CVE-2026-34209 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-34209

Vulnerability Analysis

This vulnerability stems from improper validation logic in the tempo/session cooperative close handler within the mppx payment protocol interface. The core issue involves a boundary condition error (CWE-294) where the validation check uses a strict less-than operator (<) rather than a less-than-or-equal operator (<=) when comparing the close voucher amount against the on-chain settled amount.

In payment channel protocols, the close voucher represents the final state of transactions between parties. The settled amount on-chain represents funds that have already been committed. Proper validation should ensure that a new close voucher must commit additional funds beyond what's already settled—meaning the voucher amount must be strictly greater than the settled amount.

The vulnerable code calculated a minimum close amount based on the maximum of the spent amount and the on-chain settled amount, then only checked if the voucher's cumulative amount was less than this minimum. This allowed an attacker to submit a close voucher with an amount exactly equal to the on-chain settled amount, bypassing the validation and closing the channel without providing any new funds.

Root Cause

The root cause is an improper boundary condition validation in the Session.ts file within the tempo server component. The original implementation combined two separate validation requirements (spent amount and on-chain settled amount) into a single check using an incorrect comparison operator. The validation logic failed to enforce that the close voucher must exceed (not just meet) the on-chain settled amount, creating an exploitable edge case at the exact boundary value.

Attack Vector

The attack can be performed over the network without requiring authentication or user interaction. An attacker with knowledge of a payment channel's on-chain settled amount can craft a close voucher with a cumulative amount exactly matching the settled amount. When submitted to the cooperative close handler, this voucher passes the flawed validation check and is accepted, allowing the attacker to close the channel without contributing additional funds. This enables denial-of-service style attacks against payment channels, disrupting legitimate payment operations.

     throw new ChannelClosedError({ reason: 'channel is finalized on-chain' })
   }
 
-  const minCloseAmount = channel.spent > onChain.settled ? channel.spent : onChain.settled
-  if (voucher.cumulativeAmount < minCloseAmount) {
+  if (voucher.cumulativeAmount < channel.spent) {
     throw new VerificationFailedError({
-      reason: `close voucher amount must be >= ${minCloseAmount} (max of spent and on-chain settled)`,
+      reason: `close voucher amount must be >= ${channel.spent} (spent)`,
+    })
+  }
+  if (voucher.cumulativeAmount <= onChain.settled) {
+    throw new VerificationFailedError({
+      reason: `close voucher amount must be > ${onChain.settled} (on-chain settled)`,
     })
   }
 

Source: GitHub Commit Update

Detection Methods for CVE-2026-34209

Indicators of Compromise

• Close voucher submissions with cumulative amounts exactly matching on-chain settled amounts
• Unexpected channel closures without corresponding fund commitments
• Multiple close attempts on the same channel in rapid succession
• Anomalous patterns of channel griefing across multiple payment channels

Detection Strategies

• Monitor cooperative close handler logs for voucher amounts that exactly equal settled amounts
• Implement alerting on channel closures that don't result in additional fund settlements
• Audit transaction logs for patterns consistent with boundary exploitation attempts
• Review application dependencies to identify vulnerable mppx versions below 0.4.11

Monitoring Recommendations

• Enable verbose logging on tempo/session close handlers to capture voucher validation details
• Set up automated dependency scanning to flag mppx versions prior to 0.4.11
• Monitor payment channel state changes for anomalous close patterns
• Implement real-time alerting for failed validation attempts that may indicate exploitation probing

How to Mitigate CVE-2026-34209

Immediate Actions Required

• Upgrade mppx to version 0.4.11 or later immediately
• Review payment channel logs for any historical exploitation attempts
• Audit any channels that were closed during the vulnerable period for suspicious activity
• Notify users of payment channel services about the potential for past griefing attacks

Patch Information

The vulnerability has been patched in mppx version 0.4.11. The fix separates the validation logic into two distinct checks: one ensuring the voucher amount is greater than or equal to the spent amount, and another ensuring it is strictly greater than the on-chain settled amount. This eliminates the boundary condition exploit. The patch is available via the GitHub Release v0.4.11 and detailed in the GitHub Security Advisory GHSA-mv9j-8jvg-j8mr.

Workarounds

• If immediate upgrade is not possible, implement additional server-side validation to reject close vouchers with amounts equal to settled amounts
• Consider temporarily disabling cooperative channel close functionality until the patch can be applied
• Implement rate limiting on close voucher submissions to reduce griefing impact

# Configuration example
# Update mppx to patched version
npm update mppx@0.4.11

# Verify installed version
npm list mppx