CVE-2024-34694 - CVE House
Back to Database
Status published High CVE-2024-34694

LNbits improperly handles potential network and payment failures when using Eclair backend

Vulnerability Description

LNbits is a Lightning wallet and accounts system. Paying invoices in Eclair that do not get settled within the internal timeout (about 30s) lead to a payment being considered failed, even though it may still be in flight. This vulnerability can lead to a total loss of funds for the node backend. This vulnerability is fixed in 0.12.6.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-34694

Credits & Attribution

No credits recorded in the NVD database.

References

More from lnbits

View All →
CVE-2025-32013
Server-Side Request Forgery via LNURL Authentication Callback in LNbits Lightning Network Payment System
Critical 9.3

Affected Vendor

Affected Software

lnbits
Vulnerable Versions:
< 0.12.6

Timeline

Official Publish: June 14th, 2024
Last Modified: August 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weaknesses (CWE)

CWE-754

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1499 Endpoint Denial of Service
Impact
T1562 Impair Defenses
Defense Evasion
T1005 Data from Local System
Collection