VULNERABILITY INTELLIGENCE

CVE-2025-32013

CVSS score7.5 HIGH
EPSS probability0.66%
CISA KEVNot currently listed
Published2025-04-06
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

LNbits is a Lightning wallet and accounts system. A Server-Side Request Forgery (SSRF) vulnerability has been discovered in LNbits' LNURL authentication handling functionality. When processing LNURL authentication requests, the application accepts a callback URL parameter and makes an HTTP request to that URL using the httpx library with redirect following enabled. The application doesn't properly validate the callback URL, allowing attackers to specify internal network addresses and access internal resources.

Weakness classification

  • security-advisories@github.com: CWE-918

Primary references