High severity8.1NVD Advisory· Published Jun 14, 2024· Updated Apr 15, 2026

CVE-2024-34694

Description

LNbits is a Lightning wallet and accounts system. Paying invoices in Eclair that do not get settled within the internal timeout (about 30s) lead to a payment being considered failed, even though it may still be in flight. This vulnerability can lead to a total loss of funds for the node backend. This vulnerability is fixed in 0.12.6.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
lnbitsPyPI	< 0.12.6	0.12.6

Patches

35bb3cc94b31

https://github.com/lnbits/lnbitsvia osv

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

github.com/advisories/GHSA-3j4h-h3fp-vwwwghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2024-34694ghsaADVISORY
github.com/lnbits/lnbits/security/advisories/GHSA-3j4h-h3fp-vwwwnvdWEB

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000