CVE-2024-34694

LNbits improperly handles potential network and payment failures when using Eclair backend

State: Published
Severity: 8.1 High
Published: Jun 14, 2024
Updated: Aug 2, 2024
Reserved: May 7, 2024

Description

LNbits is a Lightning wallet and accounts system. Paying invoices in Eclair that do not get settled within the internal timeout (about 30s) lead to a payment being considered failed, even though it may still be in flight. This vulnerability can lead to a total loss of funds for the node backend. This vulnerability is fixed in 0.12.6.

Scores

CVSS	Score	Vector	Source
3.1	8.1 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H	GitHub_M

Weaknesses

CWE-754 Improper Check for Unusual or Exceptional Conditions

Affected Products

Product	Versions
lnbitslnbits	< 0.12.6Affected

References

https://github.com/lnbits/lnbits/security/advisories/GHSA-3j4h-h3fp-vwww

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.