CVE-2024-34694highCWE-754

CVE-2024-34694: high-severity vulnerability in lnbits

LNbits improperly handles potential network and payment failures when using Eclair backend

Published · Updated

Follow this CVE+ Monitor lnbits+ Monitor lnbits

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.1epss 0.6%
LNbits is a Lightning wallet and accounts system. Paying invoices in Eclair that do not get settled within the internal timeout (about 30s) lead to a payment being considered failed, even though it may still be in flight. This vulnerability can lead to a total loss of funds for the node backend. This vulnerability is fixed in 0.12.6.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Affected products
lnbits · lnbits
Related CVEs — lnbits

In the same product, most dangerous first.

CVE-2025-32013CRITICALServer-Side Request Forgery via LNURL Authentication Callback in LNbits Lightning Network Payment SystemEPSS 0.7%