---
title: "GHSA-fxc9-7j2w-vx54: mpp has multiple payment bypass and griefing vulnerabilities"
url: https://erroneo.us/security/ghsa/GHSA-fxc9-7j2w-vx54/
description: "GHSA-fxc9-7j2w-vx54 (critical, crates.io (Rust)): mpp has multiple payment bypass and griefing vulnerabilities. Impact Multiple vulnerabilities were…"
type: advisory
section: "Security Digest"
date_published: 2026-03-29
date_modified: 2026-04-01
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-fxc9-7j2w-vx54"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-fxc9-7j2w-vx54: mpp has multiple payment bypass and griefing vulnerabilities

## Affected packages

- crates.io (Rust) `mpp` < 0.8.0 → fixed: 0.8.0

## Details

Impact Multiple vulnerabilities were discovered which allowed for undesirable behaviors, including: - Performing free tempo/charge requests - Replaying existing tempo/charge requests - Performing free tempo/session requests - Piggybacking off existing tempo/session channels - Griefing existing tempo/session channels - Manipulate the fee payer of a tempo/charge or tempo/session handler into paying for requests - Replaying existing stripe/charge requests Patches The issues are patched in 0.8.0 Workarounds There are no workarounds available for these vulnerabilities

## Sources

- [GitHub Advisory GHSA-fxc9-7j2w-vx54](https://github.com/advisories/GHSA-fxc9-7j2w-vx54)
- [github.com](https://github.com/tempoxyz/mpp-rs/security/advisories/GHSA-fxc9-7j2w-vx54)
- [github.com](https://github.com/tempoxyz/mpp-rs/releases/tag/v0.8.0)

---
Source page: https://erroneo.us/security/ghsa/GHSA-fxc9-7j2w-vx54/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt