CVE-2025-32013GHSA-QP8J-P87F-C8CCPYSEC-2025-16
Server-Side Request Forgery via LNURL Authentication Callback in LNbits Lightning Network Payment System
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 0.12.12
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 proof of concept on GitHub
CISA's decision points: whether it is exploited, whether attacks can be automated, and how much control an attacker gets. Assessed (SSVC 2.0.3).What do these mean? →
- Exploitation: poc
- Automatable: yes
- Technical impact: total
Summary
LNbits is a Lightning wallet and accounts system. A Server-Side Request Forgery (SSRF) vulnerability has been discovered in LNbits' LNURL authentication handling functionality. When processing LNURL authentication requests, the application accepts a callback URL parameter and makes an HTTP request to that URL using the httpx library with redirect following enabled. The application doesn't properly validate the callback URL, allowing attackers to specify internal network addresses and access internal resources.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: poc · Automatable: yes · Technical impact: total
- Record last updated
Affected versions
- lnbits lnbits
through 0.12.12
- lnbitsPyPI
through 0.12.12
- lnbitsPyPI
fixed in 0.12.12