CVE-2026-34210
HIGHmppx has Stripe charge credential replay via missing idempotency check
Title source: cnaDescription
mppx is a TypeScript interface for machine payments protocol. Prior to version 0.4.11, the stripe/charge payment method did not check Stripe's Idempotent-Replayed response header when creating PaymentIntents. An attacker could replay a valid credential containing the same spt token against a new challenge, and the server would accept the replayed Stripe PaymentIntent as a new successful payment without actually charging the customer again. This allowed an attacker to pay once and consume unlimited resources by replaying the credential. This issue has been patched in version 0.4.11.
References (3)
Scores
CVSS v3
8.1
EPSS
0.0004
EPSS Percentile
13.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-697
Status
published
Products (2)
npm/mppx
0 - 0.4.11npm
wevm/mppx
< 0.4.11 (2 CPE variants)
Published
Mar 31, 2026
Tracked Since
Mar 31, 2026