CVE-2024-34694CWE-754

LNbits improperly handles potential network and payment failures when using Eclair backend

High · published June 14, 2024

CVSS v3.1
8.1
EPSS
1%
Percentile
48.1
In the wild
Unconfirmed
What it is

LNbits is a Lightning wallet and accounts system. Paying invoices in Eclair that do not get settled within the internal timeout (about 30s) lead to a payment being considered failed, even though it may still be in flight. This vulnerability can lead to a total loss of funds for the node backend. This vulnerability is fixed in 0.12.6.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00602 · 48.1th percentile
Weakness
CWE-754 · Improper Check for Unusual or Exceptional Conditions
Published
2024-06-14T14:31Z
EPSS history
Timeline
  • 14 JUN 14:31Z
    LNbits improperly handles potential network and payment failures when using Eclair backend
    cvelistv5