mppx has Stripe charge credential replay via missing idempotency check
GHSA-8mhj-rffc-rcvw · CVE-2026-34210
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Impact
The stripe/charge payment method did not check Stripe's Idempotent-Replayed response header when creating PaymentIntents. An attacker could replay a valid credential containing the same spt token against a new challenge, and the server would accept the replayed Stripe PaymentIntent as a new successful payment without actually charging the customer again. This allowed an attacker to pay once and consume unlimited resources by replaying the credential.
Patches
Fixed in 0.4.11. The server now checks the Idempotent-Replayed header and rejects replayed PaymentIntents.
Workarounds
There are no workarounds available for this vulnerability.
References
- WEB https://github.com/wevm/mppx/security/advisories/GHSA-8mhj-rffc-rcvw
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-34210
- WEB https://github.com/wevm/mppx/commit/b2b1a0b60506fc71aa80b8a025084949dca1a994
- PACKAGE https://github.com/wevm/mppx
- WEB https://github.com/wevm/mppx/releases/tag/mppx%400.4.11
- WEB https://github.com/wevm/mppx/releases/tag/mppx@0.4.11
Ready to move
Start Securing
Free, no credit card | First findings in minutes