CVE-2025-32013criticalCWE-918

CVE-2025-32013: fallo crítico en lnbits

Server-Side Request Forgery via LNURL Authentication Callback in LNbits Lightning Network Payment System

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear lnbits+ Monitorear lnbits

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.3epss 0.7%
LNbits is a Lightning wallet and accounts system. A Server-Side Request Forgery (SSRF) vulnerability has been discovered in LNbits' LNURL authentication handling functionality. When processing LNURL authentication requests, the application accepts a callback URL parameter and makes an HTTP request to that URL using the httpx library with redirect following enabled. The application doesn't properly validate the callback URL, allowing attackers to specify internal network addresses and access internal resources.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Productos afectados
lnbits · lnbits
CVEs relacionadas — lnbits

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-34694HIGHLNbits improperly handles potential network and payment failures when using Eclair backendEPSS 0.6%