Approved changes feed: RSS · Atom
cpe:2.3:a:lnbits:lnbits:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Lnbits (e14bb7a4-8eb3-587f-b858-f20a676a1404) |
|---|---|
| Product | Lnbits (4e8752ed-7856-5d8e-907c-ba5a7fef22aa) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:docker/lnbits/lnbits |
purl2cpe | 2026-06-01 10:16:02.807464 |
pkg:github/lnbits/lnbits |
purl2cpe | 2026-06-01 10:16:02.807467 |
pkg:pypi/lnbits |
purl2cpe | 2026-06-01 10:16:02.807470 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-32013 |
vulnerable | 2026-06-08 07:18:58.952096 |
Server-Side Request Forgery via LNURL Authentication Callback in LNbits Lightning Network Payment System
LNbits is a Lightning wallet and accounts system. A Server-Side Request Forgery (SSRF) vulnerability has been discovered in LNbits' LNURL authentication handling functionality. When processing LNURL authentication requests, the application accepts a callback URL parameter and makes an HTTP request to that URL using the httpx library with redirect following enabled. The application doesn't properly validate the callback URL, allowing attackers to specify internal network addresses and access internal resources.
Published: 2025-04-06T20:07:05.624Z
Updated: 2025-04-07T14:08:48.776Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-34694 |
vulnerable | 2026-06-08 06:37:34.863599 |
LNbits improperly handles potential network and payment failures when using Eclair backend
HIGH (8.1)
LNbits is a Lightning wallet and accounts system. Paying invoices in Eclair that do not get settled within the internal timeout (about 30s) lead to a payment being considered failed, even though it may still be in flight. This vulnerability can lead to a total loss of funds for the node backend. This vulnerability is fixed in 0.12.6.
Published: 2024-06-14T14:31:12.465Z
Updated: 2024-08-02T02:59:21.774Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.