CVE-2026-34210
Wevm Mppx ≤ 0.4.11
Raw vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-34210 is a medium-severity Incorrect Comparison (CWE-697) vulnerability in Wevm Mppx. Its CVSS base score is 6.0 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Obfuscated Files or Information (T1027); ranked at the 41th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and AC-25 (Reference Monitor) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-34210 is a vulnerability in mppx, a TypeScript interface for the machine payments protocol, affecting versions prior to 0.4.11. The stripe/charge payment method fails to check Stripe's Idempotent-Replayed response header when creating PaymentIntents, enabling replay attacks. This flaw, classified under CWE-697 with a CVSS score of 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), allows attackers to reuse valid credentials without proper validation.
An attacker with low privileges, such as a legitimate user who has successfully made one payment, can exploit this by replaying a valid credential containing the same spt token against a new challenge. The server accepts the replayed Stripe PaymentIntent as a new successful payment without charging the customer again, enabling the attacker to pay once and consume unlimited resources through repeated replays.
The issue has been patched in mppx version 0.4.11. Mitigation details are available in the GitHub security advisory at https://github.com/wevm/mppx/security/advisories/GHSA-8mhj-rffc-rcvw, the release notes at https://github.com/wevm/mppx/releases/tag/mppx@0.4.11, and the fixing commit at https://github.com/wevm/mppx/commit/b2b1a0b60506fc71aa80b8a025084949dca1a994. Security practitioners should upgrade to version 0.4.11 or later to address this vulnerability.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-17457
Vulnerability Data
mppx is a TypeScript interface for machine payments protocol. Prior to version 0.4.11, the stripe/charge payment method did not check Stripe's Idempotent-Replayed response header when creating PaymentIntents. An attacker could replay a valid credential containing the same spt token against…
more
a new challenge, and the server would accept the replayed Stripe PaymentIntent as a new successful payment without actually charging the customer again. This allowed an attacker to pay once and consume unlimited resources by replaying the credential. This issue has been patched in version 0.4.11.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation directly exercises security-relevant comparisons to discover incorrect logic.
A reference monitor must be small and correct, structurally limiting the chance of flawed comparison logic in authorization decisions.
Security engineering principles require correct implementation of comparison logic used for access and authentication decisions.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure development practices directly require correct logic for security comparisons and thereby prevent this class of flaw.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure development lifecycle includes code review and testing that can catch incorrect comparison logic.
Application security requirements can mandate correct comparison logic for security decisions.
Secure architecture principles can require robust comparison mechanisms for access decisions.
Secure coding standards directly address avoiding incorrect comparison operators and logic.
Security testing can detect incorrect comparison flaws before deployment.
Secure authentication mechanisms rely on correct comparison of credentials or tokens.