CVE-2024-34694 - Vulnerability Details - OpenCVE

LNbits is a Lightning wallet and accounts system. Paying invoices in Eclair that do not get settled within the internal timeout (about 30s) lead to a payment being considered failed, even though it may still be in flight. This vulnerability can lead to a total loss of funds for the node backend. This vulnerability is fixed in 0.12.6.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00091.

Key SSVC decision points have not yet been added.

Vendors	Products
Lnbits	Lnbits

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors	Products
Lnbits	Lnbits

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/lnbits/lnbits/security/advisories/GHSA-3j4h-h3fp-vwww

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2024-06-14T14:31:12.465Z

Updated: 2024-08-02T02:59:21.774Z

Reserved: 2024-05-07T13:53:00.131Z

Link: CVE-2024-34694

Vulnrichment

Updated: 2024-08-02T02:59:21.774Z

NVD

Status : Awaiting Analysis

Published: 2024-06-14T15:15:50.637

Modified: 2024-11-21T09:19:12.763

Link: CVE-2024-34694

Redhat

No data.

OpenCVE Enrichment

Updated: 2025-07-12T22:16:10Z

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-34694", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-05-07T13:53:00.131Z", "datePublished": "2024-06-14T14:31:12.465Z", "dateUpdated": "2024-08-02T02:59:21.774Z"}, "containers": {"cna": {"title": "LNbits improperly handles potential network and payment failures when using Eclair backend", "problemTypes": [{"descriptions": [{"cweId": "CWE-754", "lang": "en", "description": "CWE-754: Improper Check for Unusual or Exceptional Conditions", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/lnbits/lnbits/security/advisories/GHSA-3j4h-h3fp-vwww", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/lnbits/lnbits/security/advisories/GHSA-3j4h-h3fp-vwww"}], "affected": [{"vendor": "lnbits", "product": "lnbits", "versions": [{"version": "< 0.12.6", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-06-14T14:31:12.465Z"}, "descriptions": [{"lang": "en", "value": "LNbits is a Lightning wallet and accounts system. Paying invoices in Eclair that do not get settled within the internal timeout (about 30s) lead to a payment being considered failed, even though it may still be in flight. This vulnerability can lead to a total loss of funds for the node backend. This vulnerability is fixed in 0.12.6.\n"}], "source": {"advisory": "GHSA-3j4h-h3fp-vwww", "discovery": "UNKNOWN"}}, "adp": [{"affected": [{"vendor": "lnbits", "product": "lnbits", "cpes": ["cpe:2.3:a:lnbits:lnbits:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "0.12.6", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-15T20:13:48.624804Z", "id": "CVE-2024-34694", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-15T20:17:01.278Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T02:59:21.774Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/lnbits/lnbits/security/advisories/GHSA-3j4h-h3fp-vwww", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/lnbits/lnbits/security/advisories/GHSA-3j4h-h3fp-vwww"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/lnbits/lnbits/security/advisories/GHSA-3j4h-h3fp-vwww", "name": "https://github.com/lnbits/lnbits/security/advisories/GHSA-3j4h-h3fp-vwww", "tags": ["x_refsource_CONFIRM", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T02:59:21.774Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-34694", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-15T20:13:48.624804Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:lnbits:lnbits:*:*:*:*:*:*:*:*"], "vendor": "lnbits", "product": "lnbits", "versions": [{"status": "affected", "version": "0", "lessThan": "0.12.6", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-15T20:16:56.262Z"}}], "cna": {"title": "LNbits improperly handles potential network and payment failures when using Eclair backend", "source": {"advisory": "GHSA-3j4h-h3fp-vwww", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "lnbits", "product": "lnbits", "versions": [{"status": "affected", "version": "< 0.12.6"}]}], "references": [{"url": "https://github.com/lnbits/lnbits/security/advisories/GHSA-3j4h-h3fp-vwww", "name": "https://github.com/lnbits/lnbits/security/advisories/GHSA-3j4h-h3fp-vwww", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "LNbits is a Lightning wallet and accounts system. Paying invoices in Eclair that do not get settled within the internal timeout (about 30s) lead to a payment being considered failed, even though it may still be in flight. This vulnerability can lead to a total loss of funds for the node backend. This vulnerability is fixed in 0.12.6.\n"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-754", "description": "CWE-754: Improper Check for Unusual or Exceptional Conditions"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-06-14T14:31:12.465Z"}}}, "cveMetadata": {"cveId": "CVE-2024-34694", "state": "PUBLISHED", "dateUpdated": "2024-08-02T02:59:21.774Z", "dateReserved": "2024-05-07T13:53:00.131Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-06-14T14:31:12.465Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}