pypi lnbits vulnerabilities

Latest pypi lnbits CVEs

Newest publication first

1. CVE-2025-32013 Server-Side Request Forgery via LNURL Authentication Callback in LNbits Lightning Network Payment System

   Published 2025-04-06

   Critical·CVSS 9.3 EPSS 0.66%

   LNbits is a Lightning wallet and accounts system. A Server-Side Request Forgery (SSRF) vulnerability has been discovered in LNbits' LNURL authentication handling functionality. When processing LNURL authentication requests, the application accepts a callback URL parameter and mak...

2. CVE-2024-34694 LNbits improperly handles potential network and payment failures when using Eclair backend

   Published 2024-06-14

   High·CVSS 8.1 EPSS 0.60%

   LNbits is a Lightning wallet and accounts system. Paying invoices in Eclair that do not get settled within the internal timeout (about 30s) lead to a payment being considered failed, even though it may still be in flight. This vulnerability can lead to a total loss of funds for t...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.