CVE-2026-73136
Static memo configuration in mpp Tempo disables per-challenge attribution binding, enabling third-party replay
CVSS score
8.2
EPSS probability
%0.6
Risk score
0.0
Published
1 mo ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
No verified public exploit code was found.
GitHub repositories, NVD exploit references and the Metasploit Framework were scanned. A record of active exploitation does not mean that public exploit code has been published.
Similar Vulnerabilities
8.7
CVE-2026-67581
On-chain transfer proof is not single-use in mpp EVM payment method, enabling cross-challenge replay
Z
Patch verifiedEPSS %1
8.3
CVE-2026-73541
Tempo fee sponsorship in mpp bounds each transaction but not aggregate exposure, allowing concurrent sponsor-wallet drain
Z
Patch verifiedEPSS %1
8.2
CVE-2026-87119
mpp Tempo subscription key authorization is not bound to the issuing challenge, allowing a captured activation credential to be replayed
Z
Patch verifiedEPSS %1
6.3
CVE-2026-88255
mpp Tempo keys its pre-broadcast dedup reserve on the caller-supplied transaction encoding, so a re-encoded signed transaction reserves a second slot
Z
Patch verifiedEPSS %1
6.3
CVE-2026-89186
mpp writes Payment-Receipt and Cache-Control before the wrapped application runs, letting a consumer's own Cache-Control expose paid responses to shared caches
Z
Patch verifiedEPSS %1
7.1
CVE-2026-89420
Session voucher adding no new funds is accepted without a charge in mpp, serving paid resources for free
Z
Patch verifiedEPSS %0
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.enginteksut.com.tr/api/v1/intel/cves/CVE-2026-73136"