AIKIDO-2026-967133

TL;DR

The Tempo session SSE transport emits each streamed value as an event: message block by interpolating the raw value directly into the data: field. When streamed content contains newline characters, the extra lines are parsed by the client as additional SSE fields, letting untrusted multiline payloads inject forged payment-need-voucher or payment-receipt control events into the stream. This allows an upstream or attacker-controlled stream to forge downstream payment control events and manipulate the client's metered-payment flow. The fix adds a message formatter that splits values on newlines and re-emits each line as its own data: field so embedded newlines can no longer break out of the message payload.