CVE-2025-32013
High
Description
LNbits is a Lightning wallet and accounts system. A Server-Side Request Forgery (SSRF) vulnerability has been discovered in LNbits' LNURL authentication handling functionality. When processing LNURL authentication requests, the application accepts a callback URL parameter and makes an HTTP request to that URL using the httpx library with redirect following enabled. The application doesn't properly validate the callback URL, allowing attackers to specify internal network addresses and access internal resources.
SeverityHigh
CVSS7.5
Exploit probability—
ProductLnbits
PublishedApr 6, 2025
First seenApr 6, 2025
Weakness typeCWE-918Server-side request forgery (SSRF)
How to fix
Update
- lnbits lnbits0.12.12 or later
- lnbits0.12.12 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lnbits lnbits | v < 0.12.12 | 0.12.12 |
| lnbitsPyPI | v ≤ 0.12.12, v < 0.12.12 | 0.12.12 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.