VulnerableCode Package Details - pkg:pypi/lnbits@0.12.6

Search for packages

Vulnerability	Summary	Fixed by
VCID-67ee-6hu6-mue1 Aliases: CVE-2025-32013 GHSA-qp8j-p87f-c8cc PYSEC-2025-16	LNbits is a Lightning wallet and accounts system. A Server-Side Request Forgery (SSRF) vulnerability has been discovered in LNbits' LNURL authentication handling functionality. When processing LNURL authentication requests, the application accepts a callback URL parameter and makes an HTTP request to that URL using the httpx library with redirect following enabled. The application doesn't properly validate the callback URL, allowing attackers to specify internal network addresses and access internal resources.	0.12.12 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 1.0.0rc1 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-67ee-6hu6-mue1
Aliases:
CVE-2025-32013
GHSA-qp8j-p87f-c8cc
PYSEC-2025-16

LNbits is a Lightning wallet and accounts system. A Server-Side Request Forgery (SSRF) vulnerability has been discovered in LNbits' LNURL authentication handling functionality. When processing LNURL authentication requests, the application accepts a callback URL parameter and makes an HTTP request to that URL using the httpx library with redirect following enabled. The application doesn't properly validate the callback URL, allowing attackers to specify internal network addresses and access internal resources.

0.12.12
Affected by 1 other vulnerability.

1.0.0rc1
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
VCID-epbm-jk4z-6bf4	LNbits improperly handles potential network and payment failures when using Eclair backend Paying invoices in Eclair that do not get settled within the internal timeout (about 30s) lead to a payment being considered failed, even though it may still be in flight.	CVE-2024-34694 GHSA-3j4h-h3fp-vwww

Vulnerability

Summary

Aliases

VCID-epbm-jk4z-6bf4

LNbits improperly handles potential network and payment failures when using Eclair backend Paying invoices in Eclair that do not get settled within the internal timeout (about 30s) lead to a payment being considered failed, even though it may still be in flight.

CVE-2024-34694
GHSA-3j4h-h3fp-vwww

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-06T05:46:10.853807+00:00	GitLab Importer	Affected by	VCID-67ee-6hu6-mue1	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/lnbits/CVE-2025-32013.yml	38.6.0
2026-06-05T21:45:26.864259+00:00	GHSA Importer	Fixing	VCID-epbm-jk4z-6bf4	https://github.com/advisories/GHSA-3j4h-h3fp-vwww	38.6.0
2026-06-05T17:04:30.454015+00:00	PyPI Importer	Affected by	VCID-67ee-6hu6-mue1	https://osv-vulnerabilities.storage.googleapis.com/PyPI/all.zip	38.6.0
2026-06-04T16:51:02.894334+00:00	GithubOSV Importer	Fixing	VCID-epbm-jk4z-6bf4	https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-3j4h-h3fp-vwww/GHSA-3j4h-h3fp-vwww.json	38.6.0
2026-06-04T16:21:58.021293+00:00	GitLab Importer	Fixing	VCID-epbm-jk4z-6bf4	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/lnbits/CVE-2024-34694.yml	38.6.0
2026-06-02T04:22:56.449630+00:00	Pypa Importer	Affected by	VCID-67ee-6hu6-mue1	https://github.com/pypa/advisory-database/blob/main/vulns/lnbits/PYSEC-2025-16.yaml	38.6.0