High severity8.1OSV Advisory· Published Jun 14, 2024· Updated Apr 15, 2026

CVE-2024-34694

Description

LNbits is a Lightning wallet and accounts system. Paying invoices in Eclair that do not get settled within the internal timeout (about 30s) lead to a payment being considered failed, even though it may still be in flight. This vulnerability can lead to a total loss of funds for the node backend. This vulnerability is fixed in 0.12.6.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
lnbitsPyPI	< 0.12.6	0.12.6

Affected products

Lnbits/LnbitsOSV
Range: 0.0.1, 0.1.0, 0.1.1, …
ghsa-coords
pkg:pypi/lnbits
Range: < 0.12.6

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-3j4h-h3fp-vwwwghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2024-34694ghsaADVISORY
github.com/lnbits/lnbits/security/advisories/GHSA-3j4h-h3fp-vwwwnvdWEB

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000