CVE-2025-32013 Server-Side Request Forgery via LNURL Authentication Callback in LNbits Lightning Network Payment System
Attackers can exploit SSRF in LNbits LNURL authentication to access internal network resources by manipulating callback URLs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-32013?
CVE-2025-32013 is a critical server-side request forgery vulnerability in lnbits, published on 6 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
LNbits is a Lightning wallet and accounts system. A Server-Side Request Forgery (SSRF) vulnerability has been discovered in LNbits' LNURL authentication handling functionality. When processing LNURL authentication requests, the application accepts a callback URL parameter and makes an HTTP request to that URL using the httpx library with redirect following enabled. The application doesn't properly validate the callback URL, allowing attackers to specify internal network addresses and access internal resources.
Weakness: CWE-918
Which versions are affected by CVE-2025-32013?
3 open source packages ship an affected version, including lnbits. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
lnbits PyPI | All versions to 0.12.12 | None |
lnbits PyPI | All versions to 0.12.12 | None |
lnbits PyPI | All versions | 0.12.12 |
Products include Lnbits Lnbits.
How do I fix CVE-2025-32013?
Upgrade lnbits to 0.12.12 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2025-32013 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-32013 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-qp8j-p87f-c8cc, PYSEC-2025-16.