CVE-2024-34694 LNbits improperly handles potential network and payment failures when using Eclair backend
Attackers can cause total loss of funds by exploiting improper handling of network timeouts in the Eclair backend integration.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-34694?
CVE-2024-34694 is a high-severity vulnerability in lnbits, published on 14 Jun 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
LNbits is a Lightning wallet and accounts system. Paying invoices in Eclair that do not get settled within the internal timeout (about 30s) lead to a payment being considered failed, even though it may still be in flight. This vulnerability can lead to a total loss of funds for the node backend. This vulnerability is fixed in 0.12.6.
Weakness: CWE-754
Which versions are affected by CVE-2024-34694?
3 open source packages ship an affected version, including lnbits.
| Package | Affected | Fixed in |
|---|---|---|
lnbits PyPI | All versions | 0.12.6 |
lnbits PyPI | All versions | 0.12.6 |
lnbits PyPI | All versions | 0.12.6 |
How do I fix CVE-2024-34694?
Upgrade lnbits to 0.12.6 or later.
Is CVE-2024-34694 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-34694 exists.
Sources
Also known as GHSA-3j4h-h3fp-vwww, PYSEC-2026-1580.