VulnerableCode Package Details - pkg:pypi/lnbits@0.10.3.dev1

Search for packages

Vulnerability	Summary	Fixed by
VCID-67ee-6hu6-mue1 Aliases: CVE-2025-32013 GHSA-qp8j-p87f-c8cc PYSEC-2025-16	LNbits is a Lightning wallet and accounts system. A Server-Side Request Forgery (SSRF) vulnerability has been discovered in LNbits' LNURL authentication handling functionality. When processing LNURL authentication requests, the application accepts a callback URL parameter and makes an HTTP request to that URL using the httpx library with redirect following enabled. The application doesn't properly validate the callback URL, allowing attackers to specify internal network addresses and access internal resources.	0.12.12 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 1.0.0rc1 Affected by 0 other vulnerabilities.
VCID-epbm-jk4z-6bf4 Aliases: CVE-2024-34694 GHSA-3j4h-h3fp-vwww	LNbits improperly handles potential network and payment failures when using Eclair backend Paying invoices in Eclair that do not get settled within the internal timeout (about 30s) lead to a payment being considered failed, even though it may still be in flight.	0.12.6 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-67ee-6hu6-mue1
Aliases:
CVE-2025-32013
GHSA-qp8j-p87f-c8cc
PYSEC-2025-16

LNbits is a Lightning wallet and accounts system. A Server-Side Request Forgery (SSRF) vulnerability has been discovered in LNbits' LNURL authentication handling functionality. When processing LNURL authentication requests, the application accepts a callback URL parameter and makes an HTTP request to that URL using the httpx library with redirect following enabled. The application doesn't properly validate the callback URL, allowing attackers to specify internal network addresses and access internal resources.

0.12.12
Affected by 1 other vulnerability.

1.0.0rc1
Affected by 0 other vulnerabilities.

VCID-epbm-jk4z-6bf4
Aliases:
CVE-2024-34694
GHSA-3j4h-h3fp-vwww

LNbits improperly handles potential network and payment failures when using Eclair backend Paying invoices in Eclair that do not get settled within the internal timeout (about 30s) lead to a payment being considered failed, even though it may still be in flight.

0.12.6
Affected by 1 other vulnerability.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-06T05:46:10.845321+00:00	GitLab Importer	Affected by	VCID-67ee-6hu6-mue1	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/lnbits/CVE-2025-32013.yml	38.6.0
2026-06-06T05:08:19.735979+00:00	GitLab Importer	Affected by	VCID-epbm-jk4z-6bf4	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/lnbits/CVE-2024-34694.yml	38.6.0
2026-06-05T17:04:30.451613+00:00	PyPI Importer	Affected by	VCID-67ee-6hu6-mue1	https://osv-vulnerabilities.storage.googleapis.com/PyPI/all.zip	38.6.0
2026-06-02T04:22:56.445056+00:00	Pypa Importer	Affected by	VCID-67ee-6hu6-mue1	https://github.com/pypa/advisory-database/blob/main/vulns/lnbits/PYSEC-2025-16.yaml	38.6.0