EEF-CVE-2026-89420

## Summary

Improper Validation of Specified Quantity in Input in ZenHive mpp allows a client holding an open payment channel to obtain paid resources without being charged.

`MPP.Session.Actions.accept_voucher/3` in `lib/mpp/session/actions.ex` treats a voucher whose `cumulativeAmount` equals the channel's already-accepted cumulative amount as an idempotent success, returning the channel unchanged without calling `maybe_spend/2`. The credential verifies, the protected resource is served, and `spent` and `units` stay where they were. Because the server issues a fresh challenge per request and the credential replay store keys on challenge id and payload, the same signed voucher can be re-presented under every new challenge, so one paid voucher yields an unbounded number of paid units. The path is reachable from any method built on `MPP.Session.Method` through the Plug, MCP, JSON-RPC and WebSocket transports.

This issue affects mpp: from 0.14.0 before 0.16.2.

## Impact

A client that has opened and funded a payment channel once can re-present the same signed voucher indefinitely and receive paid resources without any further charge. Operators running mpp as paid-API middleware lose revenue in proportion to how much the client consumes, with nothing in the channel state recording the usage.